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Abstract 



Merging operators aim at defining the beliefs/goals of a group of agents from the 
beliefs/goals of each member of the group. Whenever an agent of the group has preferences 
over the possible results of the merging process (i.e., the possible merged bases), she can 
try to rig the merging process by lying on her true beliefs/goals if this leads to a better 
merged base according to her point of view. Obviously, strategy-proof operators are highly 
desirable in order to guarantee equity among agents even when some of them are not 
sincere. In this paper, we draw the strategy-proof landscape for many merging operators 
from the literature, including model-based ones and formula-based ones. Both the general 
case and several restrictions on the merging process are considered. 

1. Introduction 

Merging operators aim at defining the beliefs/goals of a group of agents from the be- 
liefs/goals of each member of the group. Though beliefs and goals are distinct notions, 
merging operators can typically be used for merging either beliefs or goals. Thus, most of 
the logical properties from the literature (Revesz, 1993, 1997; Konieczny & Pino Perez, 1998, 
2002) for characterizing rational belief merging operators can be used for characterizing as 
well rational goal merging operators. 

Whatever beliefs or goals are to be merged, there are numerous situations where agents 
have preferences on the possible results of the merging process (i.e., the merged bases). As 
far as goals are concerned, an agent is surely satisfied when her individual goals are chosen 
as the goals of the group. In the case of belief merging, an agent can be interested in 
imposing her beliefs to the group (i.e., "convincing" the other agents), especially because 
the result of a further decision stage at the group level may depend on the beliefs of the 
group. 

So, as soon as an agent participates to a merging process, the strategy-proofness problem 
has to be considered. The question is: is it possible for a given agent to improve the result of 
the merging process with respect to her own point of view by lying on her true beliefs/ goals, 
given that she knows (or at least she assumes) the beliefs/goals of each agent of the group 
and the way beliefs/goals are merged? 

As an illustration, let us consider the following scenario of goal merging (that will be 
used as a running example in the rest of the paper): 
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Example 1 Three friends, Marie, Alain and Pierre want to spend their summer holidays 
together. They have to determine whether they will go to the seaside and/or to the moun- 
tains, or to stay at home, and also to determine whether they will take a long period of 
vacations or not. The goals of Marie are to go to the seaside and to the mountains if it is 
for a long period; otherwise she wants to go to the mountains, only, or to stay at home. The 
goals of Alain are to go to the seaside if it is for a long period; or to go to the mountains 
if it is for a short period. Finally, Pierre is only interested in going to the seaside for a 
long period, otherwise he prefers to stay at home. If one uses a common merging operator 
for defining the choice of the group, ^ then the goals of the group will be either to go to the 
seaside for a long period, or to go to the mountains or to stay at home for a short period. 
Accordingly, the group may choose to go to the seaside, only, for a long period, which is not 
among the goals of Marie. However, if Marie lies and claims that, for a short period, she 
wants to go to the mountains only, or to stay at home, then the result of the merging process 
will he different. Indeed, in this case, the goals of the group will he to go to the mountains 
for a short period, or to stay at home, which corresponds to the goals of Marie. 

Similarly, the strategy-proofness issue has to be considered in many belief merging sce- 
narios, just because rational decision making typically takes account for the "true" state 
of the world. When agents have conflicting beliefs about it, belief merging can be used 
to determine what is the "true" state of the world for the group; manipulating the belief 
merging process is a way for an agent to change the resulting beliefs at the group level so as 
to make them close to her own beliefs. As a consequence, the decisions made by the group 
may also change and become closer to those the agent would made alone. For instance, 
assume that the three friends agree that the mountains must be avoided when the weather 
is bad. If the beliefs of the group is that the weather is bad, then the decision to go to 
the mountains will be given up. If Pierre believes that the weather is bad, then he may 
be tempted to make the weather is had accepted at the group level. Therefore, a collective 
decision will be not to go to the mountains. 

There are several multi-agent settings in which some agents exchange information and 
must make individual decisions based on their beliefs. In many scenarios, agents are tempted 
to get an informational advantage over other agents, which can be achieved by gathering as 
much information as possible and by hiding their own ones. Indeed, being better informed 
may help an agent making better decisions than the other agents of the group. For instance, 
Shoham and Tennenholtz (2005) investigate non-cooperative computation: each agent de- 
livers some piece of information (truthfully or not), all such pieces are used to compute 
the value of a (commonly-known) function, and this value is given back to the agents; the 
aim of each agent is to get the true value of the function, and if possible to be the only 
one to get it. In the work of Shoham and Tennenholtz (2005), information is considered at 
an abstract level; assuming that information represent beliefs and the function is a belief 
merging operator, each agent wants to get the true merged base and possibly to be the only 
one to get it. Contrastingly, in other scenarios, where decisions have to be made collectively 
and are based on the beliefs of the group, agents are satisfied if the beliefs of the group 

1. Formally, the model-based operator Ajl"'^, using the Hamming distance and the sum aggregation func- 
tion, defined in Section 3.1. 
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are close to their own beliefs. In this paper, we focus on such an issue, which has to be 
addressed in many everyday life situations. Let us illustrate this on an example: 

Example 2 There is a position available in some university. The committee in charge 
of the recruitment has to determine the right profile for this position. Four criteria are 
considered: research skills, teaching skills, relationship skills, and the past positions of the 
candidate. Suppose that a member of the committee believes that the important criteria for 
the job are research skills and relationship skills, and that it is better to recruit a candidate 
who got a good position in the past. She will be pleased by the recruitment if the group shares 
her beliefs about the right profile. So she can be tempted to manipulate the merging process 
in order to achieve such a situation. 

Determining whether a belief/goal merging operator is strategy-proof, and in the nega- 
tive case, identifying restrictions under which strategy-proofness can be ensured is thus an 
important issue. Indeed, merging operators are intended to characterize the beliefs/goals 
of a group of agents, from the beliefs/goals of each agent from the group; obviously, this 
objective cannot be reached if the agents do not report their "true" beliefs/goals, which 
can easily be the case when manipulable merging operators are used (since agents will be 
tempted to manipulate the process in such a case). 

Since merging operators are typically used in artificial systems, one can wonder whether 
strategy-proofness is really a relevant issue in this context. The answer actually depends 
on the sophistication of the agents under consideration. Thus, in a distributed database 
setting, the (low- level) agents (i.e., the databases) have typically no evaluation/preference 
on the merged base, and the strategy-proofness issue does not make sense. It is not the 
same story when the agents have goals and reasoning capacities. In this case, it cannot be 
discarded that some agents will be able to foresee weakenesses in the aggregation process 
and to exploit them for their own benefits. When high-level artificial agents are involved, 
the strategy-proofness problem is even more stricking than in the case of human agents 
because of the superior computational abilities of artificial systems. 

The strategy-proofness issue has been studied for years in the domain of Social Choice 
Theory (Arrow, Sen, & Suzumura, 2002). An important objective is to design preference 
aggregation procedures (and, in particular, voting procedures) which are strategy-proof. A 
very famous result, known as Gibbard-Sattherwaite theorem, is that this objective cannot 
be reached in an absolute manner: under a number of sensible requirements, no strategy- 
proof voting procedure may exist (Gibbard, 1973; Satterthwaite, 1975). Strategy-proofness 
can only be achieved by relaxing some of those requirements, which is enough to escape 
from Gibbard-Sattherwaite theorem. We shall return to this topic in Section 7 where the 
connections between belief merging and preference aggregation will be considered in more 
depth. 

The very objective of this paper is to draw the strategy-proofness landscape for many 
merging operators from the literature, including model-based ones and formula-based ones. 
We focused on operators for merging bases that are sets of propositional formulas, where no 
priorities between the bases are available. The (classical) propositional logic framework can 
be argued as a representation setting expressive enough for many AI scenarios; furthermore, 
it is natural to investigate first the key problems raised by aggregation and manipulation in 
this simple setting, before considering more sophisticated logics. For each operator under 
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consideration, we aim at determining whether it is strategy-proof in the general case, and 
under some restrictions on the merging process (including the number of agents and the 
presence of integrity constraints) and on the set of available strategies for the agents. 

The rest of the paper is organized as follows. In Section 2, some formal preliminaries are 
provided. In Section 3, the definitions of the main propositional merging operators from the 
literature are recalled. Several definitions of strategy-proofness based on a general notion of 
satisfaction index are given in Section 4 and our strategy-proofness results are reported in 
Section 5. They are discussed in Section 6. Then, connections with Social Choice Theory 
and other related works are pointed out in Section 7, just before the conclusion. Proofs are 
reported at the end of the paper. 

2. Formal Preliminaries 

We consider a propositional language H defined from a finite (and non-empty) set of propo- 
sitional variables V and the standard connectives, including T, the Boolean constant always 
true, and _L, the Boolean constant always false. 

An interpretation (or world) u; is a total function from V to {0, 1}, denoted by a bit 
vector whenever a strict total order on V is specified. The set of all interpretations is noted 
W. An interpretation a; is a model of a formula G £ if and only if it makes it true in the 
usual truth functional way. 

denotes the set of models of formula i.e., [i;^)] = {w € W | w ^ 0}. In order to 
avoid too heavy notations, we identify each interpretation cj with the canonical term on V 
which has uj as its unique model. For instance, if "P = {a, and Lij(a) = 1, u;(6) = 0, is 
identified with the term a A -^h. 

A formula (/> from L is consistent if and only if [0] 0. is a logical consequence of a 
formula '(/', noted il) \= and only if C [(^]. Two formulas are logically equivalent (=) 
if and only if they share the same models. 

A belief/goal hase K denotes the set of beliefs/goals of an agent. It is a finite and 
consistent set of propositional formulas, interpreted conjunctively. When X is a belief/goal 
base, K denotes the singleton base containing the conjunction /\K all formulas from 
K. A base is said to be complete if and only if it has exactly one model. Each belief/goal 
base K characterizes a bipartition of the set of all interpretations: the models of K are the 
interpretations which are acceptable for the agent, and the countermodels are not. When 
i^T is a belief base, an interpretation uj is acceptable when there is enough evidence that lo is 
the "true" state of the world; when K is a goal base, lo is acceptable when it is sufficiently 
desired. Such a bipartition can be considered as an approximation of the full belief/goal 
preference structure of the corresponding agent: in the belief case, uj is at least as preferred 
as uj' means that the fact that uj is the "true" state of the world is at least as plausible as 
the fact that u>' is the "true" state of the world; in the goal case, uj is at least as preferred as 
uj' means that the fact that uj would be the "true" state of the world is at least as desired 
as the fact that u>' would be the "true" state of the world. 

A belief/goal profile E is associated with the group of n agents involved in the merging 
process. It is a non-empty multi-set (bag) of belief/goal bases E = {i^Ti, . . . , K„} (hence 
different agents are allowed to exhibit identical bases). Note that profiles are non-ordered 
(multi-)sets; thus, the profile representation of groups of agents induces an anonymity prop- 
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erty: each agent has the same importance as the other agents of the group and the result 
of the merging process only depends on the bases themselves (i.e., exchanging the bases of 
two agents gives the same profile, hence the same merged base). 

We denote hy /\E the conjunction of bases oi E = {Ki, . . . , Kn}, i.e., /\E = {/\ Ki) A 
. . . A (/\ Kn), and we denote hy \/ E the disjunction of bases of E, i.e., \/ E = {/\ Ki) V 

...V(Ai^n). 

A profile E is said to be consistent if and only \i /\E \s consistent. The multi-set union 
is noted U and the multi-set containment relation is noted C. The cardinal of a finite set 
(or a finite multi-set) A is noted i^{A). C will denote set containment and C strict set 
containment, i.e., A C B ii and only if A Q B and A B. 

If <_E denotes a pre-order on W (i.e., a reflexive and transitive relation), then <e denotes 
the associated strict ordering defined by \/io,io' G W, w <e a;' if and only if to <e oj' and 

The result of the merging of (the bases from) a profile E with the merging operator A, 
under the integrity constraints fi is the base, noted A^{E), called the merged base. The 
integrity constraints consist of a consistent formula (or, equivalently, a (finite) consistent 
conjunction of formulas) the merged base has to satisfy (it may represent some physical laws, 
some norms, etc.); in other words, models of the merged base are models of the integrity 
constraints. 

3. Merging Operators 

We recall in this section the two main families of merging operators from the literature. The 
first family is defined by a selection of some interpretations (model-based operators). The 
second family is defined by a selection of some formulas in the union of the bases (formula- 
based operators). For more details on those two families, see for example (Konieczny, Lang, 
& Marquis, 2004). 

3.1 Model-Based Operators 

The first family is based on the selection of some models of the integrity constraints, the 
"closest" ones to the profile. Closeness is usually defined from a notion of distance and an 
aggregation function (Revesz, 1997; Konieczny & Pino Perez, 1998, 1999; Lin &: Mendelzon, 
1999; Liberatore & Schaerf, 1998). 

Definition 1 (pseudo-distances) 

• A pseudo-distance between interpretations is a total function d : W x W M"^ s.t. 
for any to, to' , to" G W: d{uj,uj') = d{uj' ,uj), and d{oj,oj') = if and only if w = uj' . 

• A distance between interpretations is a pseudo- distance that satisfies the triangular 
inequality: \/uj,uj',uj" G W, d{uj,uj') < d{uj,uj") + d{u)" ,tLi'). 

Two widely used distances between interpretations are Dalai distance (Dalai, 1988), 
denoted dn, that is the Hamming distance between interpretations (the number of propo- 
sitional atoms on which the two interpretations differ); and the drastic distance, denoted 
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do, that is one of the simplest pseudo-distances one can define: it gives if the two inter- 
pretations are the same one, and 1 otherwise. 

Definition 2 (aggregation functions) An aggregation function f is a total function as- 
sociating a nonnegative real number to every finite tuple of nonnegative real numbers s.t. 
for any xi,... ,Xn,x,y S M+z 

• if X < y, then /(xi, . . . ,x, . . . , x„) < f{xi, . . . ,y, . . . , (non-decreasingness) 

• /(xi, . . . , Xn) = if and only if xi = . . . = Xn = 0- (minimality) 

• f{x) = X. (identity) 



Widely used functions are the max (Revesz, 1997; Konieczny & Pino Perez, 2002), the 
sum S (Revesz, 1997; Lin & Mendelzon, 1999; Konieczny & Pino Perez, 1999), or the 
leximax GMax (Konieczny & Pino Perez, 1999, 2002). 

The chosen distance between interpretations induces a "distance"^ between an interpre- 
tation and a base, which in turn gives a "distance" between an interpretation and a profile, 
using the aggregation function. This latter distance gives the needed notion of closeness rep- 
resented by a pre-order on W induced by E, noted <e- Such a pre-order can be interpreted 
as a plausibility ordering associated with the merged base. 

Definition 3 (distance-based merging operators) Let d be a pseudo-distance between 
interpretations and f be an aggregation function. The result I^fl^ (E) of the merging of E 
given the integrity constraints n is defined by: 

[Af^HE]] = min(M, <e) = {oo e [fi] \ $00' G M, 00' <e 00} 
where the pre-order <e on W induced by E is defined by: 

• uj <E uj' if and only ifd{iJ,E) < d{ij',E), where 

• d{uJ,E) = fKeE{d{uj,K)), where 

• d{LL!, K) = min^i^xdi^^OjUj'). 

Observe that d'^'-l^ i^,E) would be a more correct notation than d{io,E); however, since 
there is no ambiguity in the choice of the function / and the distance between interpretations 
d in the following, we prefer the lighter notation d{uj, E). 

Let us step back to the example given in the introduction in order to illustrate model- 
based merging operators: 

Example 3 Consider the set V with three propositional variables I (long period), s(easide) 
and m(ountains), taken in this order. The goals of the three agents are then given by the 
following bases: [Ki] = {000,001,111} (Marie's wishes), [K2] = {001,110} (Alain's wishes) 
and [i^s] = {000, 110} (Pierre's wishes). There is no integrity constraint (fi = T). 

2. Abusing words since it is not a distance from the mathematical standpoint. 
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We have [A'^f'^dKi, K2, K3})] = {000,001,110}. Table 1 gives some details of the 
computation. The first column gives all possible words. The Ki (i = 1 . . .3) columns give 
for each interpretation lv the value dn^uj, Ki). Finally, the rightmost column gives for 
each interpretation u) the value of dH{uJ,{Ki,K2,K3}). The interpretations to for which 
dH{u>, {Ki, K2, K-^}) is minimal (in bold) are the models of the merged base Af/''^{{Ki, K2, 

K3})- 





Ki 


K2 


K3 




000 





1 





1 


001 








1 


1 


010 


1 


1 


1 


3 


oil 


1 


1 


2 


4 


100 


1 


1 


1 


3 


101 


1 


1 


2 


4 


110 


1 








1 


111 





1 


1 


2 



Table 1: Merging with A^"' . 
3.2 Formula-Based Operators 

The other main family of merging operators gather the so-called "formula-based operators" 
or "syntax-based operators" . Formula-based operators are based on the selection of consis- 
tent subsets of formulas in the union of the bases of the profile E. Several operators are 
obtained by letting vary the selection criterion. The result of the merging process is the 
set of consequences that can be inferred from all selected subsets (Baral, Kraus, Minker, & 
Subrahmanian, 1992; Rescher & Manor, 1970; Konieczny, 2000). For these operators, the 
syntactic form of the bases may easily influence the result of the merging process: replac- 
ing a base K = {ipi, . . . , ipn} by the (logically equivalent) base K = {ipi A ... A ipn} niay 
lead to change the corresponding merged base (while this is not the case for model-based 
operators). 

Definition 4 (maximal consistent subsets) Let K be a base and ji be an integrity con- 
straint. MAXCONS(i^, ^) is the set of all the maximal (w.r.t. set inclusion) consistent 
subsets (maxcons for short) of K D {^} that contains fi, i.e., MAXCONS (A', /i) is the set of 
all consistent M that satisfy: 

• M C KU {/x}, and 

• /X € M , and 

• If M C M' Q K U {//}, then M' is not consistent. 

When maximality must be taken with respect to cardinality (instead of set inclusion), we 
shall use the notation MAXCOf^Scm-diK, fi). 

Now, for any profile E and integrity constraint /x, we set 

MAXCONS(£', /x) = MAXCONS(|^^ ^^Ki, fi) 
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Observe that set-theoretic union (and not multi-set union) is used here. 

The following operators have been defined so far (Baral, Kraus, &: Minker, 1991; Baral 
et al, 1992; Konieczny, 2000): 

Definition 5 (formula-based merging operators) Let E he a profile and let /i he an 

integrity constraint: 

• ^^^{E) = Vj\/GMAXCONS(£;,Ai)(A^^)- 

• ^^^(E) = y M\M€MAXCO'NSiE,T) and Mu{^i} consistent(f\ ■^^) ■ 

• ^|?^(^) = M MeMAXCOmcard{E,ti)(f\ ^) ■ 

{VMeMAXCONS(£;,T) and Mu{^J.} consistent^ f\^^^ ^ ilA}) 
if consistent, 
H otherwise. 

Those operators clearly select as much formulas as they can from the union of the bases, 
under the consistency requirement. The differences between them lie in the meaning of 
"as much". Those operators were defined by Baral et al. (1992), except A*-"^ which is a 
modification of A*^^ that ensures consistency. Indeed, unlike the other operators listed here, 
A^^ may generate inconsistent merged bases (as the empty disjunction). A A*^^ operator 
has also been introduced by Baral et al. (1992), and shown equivalent to A*-"^ (this is why 
it is not listed above). An important drawback of those operators is that they do not take 
account for the sources from which the formulas are issued.^ Nevertheless, they have an 
appealing, simple definition. 

To illustrate the behaviour of formula-based operators, let us step back to the example 
given in the introduction. Since the absence of constraints makes the operators A*^^, A*^^ 
and A*-"^ coincide, we shall add the following constraint: /i = / A -is, i.e., it turns out that 
the group will have to take holidays for a long period and that they cannot go to the seaside. 

Example 4 Suppose that Marie, Alain and Pierre's goals are encoded by the following 
bases: Ki = {I ^ s,l ^ m}, K2 = {Z s, s <-> -^iri}, and = {/ <-5- s,-im}. With the 
integrity constraints fx = I A -is, MAXCONS(i?, /i) contains two sets: {I ^ m, s <^ -im} and 
{^m}. We get A'^^E) = fi, A'^^{E) = ±, A^4(S) = lA^sAm, and A'^^E) = fx. 

The "syntax sensitivity" of those operators is due to the fact that the comma symbol 
"," which appears in the expression of the bases, is a specific, yet not truth-functional, 
connective (Konieczny, Lang, & Marquis, 2005) that is usually not equivalent to standard 
conjunction in the formula-based framework. Such operators may easily lead to merged 
bases which differ from their counterparts where commas are replaced by conjunctions in 
the input bases. For example, with fi = T,Ki = {a A b},K2 = {"■(« A b)} and K[ = 
{a,b}, the fact that K[ = Ki does not imply that A^^({i^i, K2}) = A^'^{{K[,K2}), since 
A^i({i^i,i^2}) = T and A^^{{K[,K2}) = ayh. See (Konieczny et al., 2005) for a more 



3. It is possible to avoid it by taking advantage of a further selection function (Konieczny, 2000). 
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detailed discussion on the meaning of the comma connective in frameworks for reasoning 
under inconsistency. 

Clearly enough, if one replaces each base K by K, the singleton base containing the 
conjunction of its elements before making the union, the resulting operators, noted A^, are 
not any longer sensitive to the syntactic presentation of the bases (replacing every base by 
a logically equivalent one leads to the same merged base). Formally, we have: 

Definition 6 (other formula-based merging operators) Let E = {i^i, . . . ,Kn} he a 
profile and let /x he an integrity constraint: 

A«(£;) = A^'({Fi,...,F„}). 

Remark 1 Ohserve that A'-''^ is equivalent to the model-hased operator A"^^'^ = /\^d,o,GMax ^ 
Indeed, A*^^ returns the disjunction of the maximal (for cardinality) consistent suhsets of 
the profile under the constraints. This is exactly what the operator /S.'^d,^ = ^du,GMax 
achieves since it amounts to define the set of models of the merged hase as the set of in- 
terpretations that satisfy the constraints and a maximal numher of bases of the profile, i.e., 
the interpretations that are models of a maximal (for cardinality) consistent subset of the 
profile under the constraints. 



4. Strategy-Proofness 

The strategy-proofness issue for a merging operator can be stated as follows: is it possible 
for a given agent to improve the result of the merging process with respect to her own 
point of view by lying on her true beliefs/goals, given that she knows the beliefs/goals of 
each agent of the group and the way beliefs/goals are merged? If this question can be 
answered positively, then the operator is not strategy-proof (the agent may benefit from 
being untruthful). Thus, a merging operator is not strategy-proof if one can find a profile 
E = {Ki, . . . , Kn} which represents the bases of the other agents, an integrity constraint //, 
and two bases K and K' s.t. the result of the merging of E and K' is better for the agent 
than the result of the merging of E with her true base K (called the initial base). 

Definition 7 (strategy-proofness) Let i be a satisfaction index, i.e., a total function 
from £■ X C to M. 

• A profile E is said to be manipulable by a base K for i given a merging operator A and 
an integrity constraint fi if and only if there exists a base K' such that i{K, IS.^{E U 
{K']))>i{K,A^{EU{K})). 

• A merging operator A is strategy-proof for i if and only if there are no integrity 
constraint ^ and profile E = {Ki, . . . , K^} such that E is manipulable for i. 

Given two bases (interpreted conjunctively) K, Ka, the value of i{K, K/\) is intended to 
indicate how much a base K is close to the merged base Ki\. The need for such satisfaction 
indexes comes from the fact that the only information given by each agent is her own base 
K: if the full preference structure over sets of interpretations were available for each agent 
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as an additional input (e.g., under the form of a utility function), then one could use it to 
define strategy-proofness directly for a given agent (as it is done in Social Choice Theory, 
Arrow et al., 2002) and not in a uniform way for all agents. This explains why we call i a 
satisfaction index and not a utility function. 

Clearly, there are many different ways to define the satisfaction of an agent given a 
merged base. While many ad hoc definitions can be considered, we consider the following 
three indexes which are, according to us, the most meaningful ones when no additional 
information about the agents are available. As far as we know, this is the first time such 
indexes are considered in the context of pure propositional merging. 

The first two indexes are drastic ones: they range to {0, 1}, so the agent is either fully 
satisfied or not satisfied at all. 



Definition 8 (weak drastic index) 

,._Jl if K A Ka is consistent, 
I'dwK , A) Q otherwise. 

This index takes value 1 if the result of the merging process (noted K/^ in the defini- 
tion) is consistent with the agent's base (K), and otherwise. It means that the agent is 
considered fully satisfied as soon as its beliefs/goals are consistent with the merged base. 



Definition 9 (strong drastic index) 

ids{K,K/\) 



1 ifKA^K, 
otherwise. 



This index takes value 1 if the agent's base is a logical consequence of the result of the 
merging process, and otherwise. In order to be fully satisfied, the agent must impose her 
beliefs/goals to the whole group. 

The last index is not a Boolean one, leading to a more gradual notion of satisfaction. 
The more compatible the merged base with the agent's base the more satisfied the agent. 
The compatibility degree of K with K/^ is the (normalized) number of models of K that 
are models of as well: 



Definition 10 (probabilistic index) If ^{[K^]) = 0, then ip{K,KA) = 0, otherwise: 

#([/!-] n [Ka]) 



ip{K,KA) 



ip{K, K/\) is the probability to get a model of K from a uniform sampling in the models 
of Ka.. This index takes its minimal value when no model of K is in the models of the 
merged base K^., and its maximal value when each model of the merged base is a model of 
K. 

Strategy-proofness for these three indexes are not independent notions: 
Theorem 1 

1. If a merging operator is strategy-proof for ip, then it is strategy-proof for i^^. 
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2. Consider a merging operator A that generates only consistent bases.^ If it is strategy- 
proof for ip, then it is strategy-proof for ids- 

On the other hand, it is easy to prove that strategy-proofness for idw and strategy- 
proofness for ids are logicaUy independent in the general case (an operator can be strategy- 
proof for one of them without being strategy-proof for the other, and it can be strategy-proof 
for both of them or for neither). 

Let us conclude this section with our running example, and give formal arguments 
explaining how Marie can manipulate the merging process: 

Examples We consider three bases [Ki] = {000,001,111} (Marie's wishes), [K2] = 
{110,001} (Alain's wishes) and [K3] = {110,000} (Pierre's wishes). There is no constraint 
(^^ ^ T). 

[Af'^({A'i,K2,i^3})] ={000,001,110} andids{KuA'{"^''{{K^,K2,Ks}))=0. 

If Marie reports [K[] = {000,001} instead of Ki, then [Aj"'^{{K[,K2, K3})] = {000, 

001} andidsiKi,A',"'^i{K[,K2,K3})) = 1. 
See Table 2 for details of the computations. 





Ki 




K2 


K3 






000 








1 





1 


1 


001 











1 


1 


1 


010 


1 


1 


1 


1 


3 


3 


oil 


1 


1 


1 


2 


4 


4 


100 


1 


1 


1 


1 


3 


3 


101 


1 


1 


1 


2 


4 


4 


110 


1 


2 








1 


2 


111 





2 


1 


1 


2 


4 



Table 2: A'^^'^ is not strategy-proof for i^s. 



In the rest of this paper, we shall focus on those three indexes, idw, ids and ip. Note 
that investigating other indexes can be interesting. In particular, the probabilistic index 
can be viewed as a rough measure of similarity between the bases. Could more complex 
similarity measures between sets (see e.g., Tversky, 2003) also prove useful to define other 
sensible indexes is an interesting question that we let for further research. 

5. Strategy-Proofness Results 

In the general case, both the family of model-based operators and the family of formula- 
based operators are not strategy-proof for the three indexes we consider. This means that 
there are operators from those families which are not strategy-proof. However, imposing 
further restrictions may lead to some strategy-proofness results. Considering them in a 
systematic way allows us to draw the strategy-proofness landscape for both families. 

In the following, we consider four natural restrictions for the merging process, as listed 
below: 

4. I.e., Afj,{E) is always consistent. 
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• A first restriction concerns the number of bases to be merged. Tlie question is the 
following: does the number of bases involved in the merging process have an influence 
on the strategy-proofness of an operator? In general, we can answer positively to 
this question. More precisely, there is a distinction between the cases i^{E) = 2 and 
ij={E) > 2. In some situations, no manipulation is possible with two bases, while 
with more bases, it becomes possible. Since a base {T} typically plays the role of a 
"neutral element" for all the operators we consider (i.e., A^(£^) = A^{E\J{T})), if an 
operator is not strategy-proof for profiles with n bases, then it is not strategy-proof 
for profiles with m> n bases. 

• A second parameter is the completeness of the beliefs/goals of the agent who aims at 
manipulating. In some cases, having such strong beliefs/goals renders any manipula- 
tion impossible. Working with complete bases (i.e., singleton sets of models) makes 
the merging process close to a uninominal vote, i.e., a vote for a unique interpretation. 

• A third significant parameter is the presence of integrity constraints. On the one hand, 
having nontrivial integrity constraints ^ T) can make a manipulation possible, 
while it is not the case when no integrity constraints are considered, and the converse 
also holds. 

• Another restriction bears on the available manipulations. In the general case the un- 
truthful agent is free to reporting any base, even if it is "quite far" from her true base. 
However, there are numerous situations where the other agents participating to the 
merging process have some information about her true base. In these cases, the agents 
have to report some bases close to the real ones. Two particular manipulations will 
be studied: erosion manipulation when the agent pretends to believe/desire more that 
she does (the agent gives only some parts of its models); and dilatation manipulation 
when the agent pretends to believe/desire less that she does (the agent gives only 
parts of its countermodels). 

5.1 Model-Based Operators 

The first result is that there is no general strategy-proofness result (i.e., for any aggregation 
function and any distance) for model-based operators. This is not very surprising when 
one reminds the existence of Gibbard-Satterthwaite theorem, which states that there is no 
"good" strategy-proof preference aggregation method (see Section 7). 

However, some quite general strategy-proofness results can be obtained. The following 
theorem gives some of them, organized from the most general one (for any aggregation 
function when the drastic distance d£, \s considered), to more specific ones (for any distance 
d when the aggregation function is S): 

Theorem 2 

• Let f be any aggregation function. Af/^'^ is strategy-proof for ip, i^w and ids- 

• Let d be any distance. Provided that only two bases are to be merged, Ay^ is strategy- 
proof for the indexes i^w C'lT'd ids ■ 
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• For any distance d, A^' is strategy-proof for the indexes ip, i^w CLnd ids when the 
initial base K is complete. 

It is interesting to note that AJ^°'^ (which coincides with ^^D.GMax-^ ^lose to a voting 
procedure called approval voting (Brams & Fishburn, 1983), where each agent can vote for 
(approve) as many candidates as she wants, and the elected candidates are the ones who 
get the greatest number of votes. 

As shown by the running example, the family of merging operators Afi"'^ obtained 
by considering the Hamming distance and letting the aggregation function / vary is not 
strategy-proof. Let us now focus on this family, and consider successively the two operators 
obtained by considering S and GMax as aggregation functions. 

As to Afi"'^, the number of bases, the presence of integrity constraints and the com- 
pletness of the bases are significant. For this operator, the next theorem makes precise the 
boundaries between strategy-proofness and manipulation (in the following properties, K 
represents the initial base and i^{E) the number of bases in the profile E): 

Theorem 3 

• A^^'^ is strategy-proof for i^w or ids if o,nd only if (j^i = T and i^{E) = 2) or K is 
complete. 

• A^^'^ is strategy-proof for ip if and only if K is complete. 

In contrast to Aj^"'^, i^'jH,GMax strategy-proof even in very restricted situations: 

Theorem 4 

• /\^'jH,GMax strategy-proof for the satisfaction indexes idw end ip (even if fi = T, 
K is complete and i^{E) =2). 

• l^'j^n,GMax strategy-proof for the satisfaction index ids if o.nd only if jj, = T , K is 
complete and #{E) = 2. 

5.2 Formula-Based Operators 

For the probabilistic index, none of the formula-based operators Aj^^, A|^'^, A|^'^, and 
A^^ is strategy-proof. But, for the two drastic indexes, there are some situations where 
strategy-proofness can be ensured: 

Theorem 5 

• A|^^, A^^, A^^, and A|^^ are not strategy-proof for ip (even if fi = T, K is complete 
and i^{E) =2). 

• A'jj^ is strategy-proof for idw o,nd ids ■ 

• is strategy-proof for idw o,nd ids if o-nd only if fi = T . 

• A^^ is not strategy-proof for idw and ids (even if fi = T , K is complete and i^{E) =2). 
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• is strategy-proof for i^w if o-n-d only if fi = T or K is complete, and is strategy- 
proof for ids if o-nd only if fj, = T . 

For the other formula-based merging operators A^"*^, A|^^, A^^, A|^^, the results are 
more balanced, with more strategy-proofness results: 

Theorem 6 

• A^^ is strategy-proof for i^w cmd ids, o-'^d is strategy-proof for ip if and only if 
#{E) = 2. 

• is strategy-proof for idw and ids if o.nd only if = T , and is strategy-proof for ip 
if and only if #{E) = 2 and fi = T. 

• A^^ is strategy-proof for ip, idw and ids- 

• A^^ is strategy-proof for idw if and only if i^{E) = 2 or fj. = T or K is complete. 

A^^ is strategy-proof for ids if and only if i^{E) = 2 or fi = T . Finally, A^^ is 
strategy-proof for ip if and only if ^{E) = 2. 

5.3 Ensuring Strategy-Proofness: The Case of Complete Bases 

Let us now focus on a very specific case: the situation where every base is complete. While 
this situation is rather infrequent when dealing with usual belief bases, it can be imposed 
in a goal merging setting, especially if it guarantees strategy-proofness. This explains why 
we consider such a case in this paper. As said above, it is also interesting because of the 
relationship with uninominal voting systems if one interprets each complete b vote 
for the corresponding interpretation. 

Theorem 7 The strategy-proofness results reported in Table 3 hold, under the restriction 
that each base is complete (f stands for any aggregation function, and d for any distance). 
sp means '^strategy-proof" , 'sp means "non strategy-proof" even if i^{E) = 2 and fj, = T , 
'sp* means "non strategy-proof" even if either i^{E) = 2 or fi = T, but "strategy-proof" if 
both i^{E) = 2 and fi = T. Finally, Jp^ means "non strategy-proof" even if ^(E) = 2, but 
"strategy-proof" whenever n = T . 

As Theorem 7 shows, no operator among the Af,"'^^^""" and the A^ ones ensures 
full strategy-proofness in the restricted case where two complete bases are merged and 
no integrity constraint is considered. Contrastingly, all the other operators offer strategy- 
proofness for the three indexes whenever every base is complete. 

5.4 Dalai Index 

As explained before, the fact that ip is based on model counting allows some form of 
graduality in the corresponding notion of satisfaction, and this contrasts with the drastic 
indexes. Actually, other non drastic indexes can be defined. In particular, in cases where 
the agent knows that the result could not fit her beliefs/goals (e.g., if her beliefs/goals are 
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Table 3: Strategy-proofness: complete bases 



not consistent with the integrity constraints), she still can be interested in achieving a result 
that is close to her beliefs/goals. Closeness can be captured by a notion of distance, and a 
possible satisfaction index is the following "Dalai index" : 

Definition 11 (Dalai index) ioaiaiiK.K^) = 1 - min({dH{u^^^^) \ ^^K}) ^ 

As far as we know, this index has never been carried out. For the sake of homogeneity 
with previous indexes, the greater ioaiaiiK, K^) the more satisfied the agent associated 
with K. i Dalai grows antimonotonically with the Hamming distance between the two bases 
under consideration, i.e., the minimal distance between a model of the first base and a 
model of the second one. Thus, this index takes its minimal value when every variable must 
be fiipped to obtain a model of K/\ from a model of K, while it takes its maximal value 
whenever K is consistent with K/^ (no fiip is required). 

A direct observation is that loaiaiiK, K^) > idwiK, K/^), whatever the bases K and 
K/s,. Investigating the strategy-proofness of a profile E for the Dalai index given a merging 
operator A and an integrity constraint n makes sense only in the situation K A A^(E) is 
inconsistent. Indeed, in the remaining case, i^aiaiiK, Af^{E)) takes the maximal value 1 
and no manipulation is possible. 

In contrast to the three previous indexes we have considered, merging operators are not 
strategy-proof for ioaiai, even in very restricted situations. 

Theorems None of A'jf'^, /\'^o,GMax ^ A^^'^ or Aji^'*^""'' is strategy-proof for i Dalai > 
even in the restricted case where E consists of two complete bases. 

Theorem 9 None of the operators (hence, none of the operators ) is strategy-proof 
for i Dalai, even in the restricted case where E consists of two complete bases. 
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5.5 Restricted Strategies 

There are situations where the other agents participating to the merging process have some 
information about the bases of the other agents. For instance, in cooperative problem 
solving, it can be decided that whenever an agent is able to answer a query within a 
limited amount of time, she has to communicate it to the other agents. Contrastingly, the 
communication protocol may force an agent to inform the other agents that she is definitely 
not able to answer the query. Such information exchanges allow the other agents to get a 
partial view of the models or the countermodels of the true beliefs/goals of the agent, and if 
this conflicts with the reported beliefs/goals, the untruthful agent can be unmasked. That 
is clearly a wrong thing for the untruthful agent since her opinion could then be ignored; 
she can even be punished for her guilty behaviour. 

We consider here two restrictions on available manipulations (and the corresponding 
notions of strategy-proofness): erosion manipulation is when the agent pretends to be- 
lieve/desire more that she does (the agent gives only some parts of its models); and dilata- 
tion manipulation is when the agent pretends to believe/desire less that she does (the agent 
gives only parts of its countermodels). 

Definition 12 (erosion and dilation) 

• Erosion manipulation holds when the reported base K' is logically stronger than the 
true one K: K' \= K 

• Dilation manipulation holds when the reported base K' is logically weaker than the 
true one K: K \= K' . 

Erosion (resp. dilation) manipulation is safe for the untruthful agent when the other 
agents may only have access to a subset of the countermodels (resp. models) of her true 
beliefs/goals, while it is unsafe in general when the other agents may have access to a subset 
of the models (resp. countermodels). 

The next theorem gives the dilation strategy-proofness of model-based operators: 

Theorem 10 Let d be a pseudo-distance and let f be an aggregation function. Afi^ is 
dilation strategy-proof for the indexes ip, idw CLn-d ids- 

This result has to be compared with the ones in the unrestricted case (previous sections), 
where most of the operators are not strategy-proof. 

It is not the same story for erosion. One can easily find profiles that can be manipulated 
using erosion manipulation (see the running example). Interestingly, focusing on erosion 
strategy-proofness proves sufficient in some situations. Indeed, when d is any distance, S 
is the aggregation function and any drastic index id are considered, A)^'^ is strategy-proof 
for id if and only if it is erosion strategy-proof for id- 
Theorem 11 Let d be any distance. // A^'^ is not strategy-proof for the index idw (resp. 
ids), then it is not erosion strategy-proof for idw (resp. ids)- 

This result has a corollary, showing that it it enough to focus on each complete base 
that implies K to determine whether a profile E is manipulable by a base K for idw'- 
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Corollary 12 A profile E is manipulahle by K for i^yj (resp. i^s) given Aj^'^ and fi if and 
only if the manipulation is possible using a complete base \= K, i.e., there exists \= K 
s.t. idu,{K,A.f{EU{K^})) > ia^,{K,^f'{EU{K})) (resp. ids{K, /^fl^ {E U {K^})) > 
ids{K, Ai^{EU{K}))). 

6. Discussion 

In this paper, we have drawn the strategy-proofness landscape for many merging operators, 
including model-based ones and formula-based ones. While both families are not strategy- 
proof in the general case, we have shown that several restrictions on the merging framework 
or on the available strategies may lead to strategy-proofness. 

As to model-based operators, the choice of a "right" distance appears crucial. Thus, 
model-based operators are strategy-proof when based on the drastic distance, while they 
are typically not strategy-proof when based on Dalai distance. 

Among formula-based merging operators A^^ achieves the highest degree of strategy- 
proofness in the sense that it is strategy-proof for the drastic indexes. 

Most of the results are summed up in Table 4 (sp means "strategy-proof" and sp means 
"not strategy-proof"). For space reasons, the results on restricted strategies are not reported 
there (see Section 5.5), as well as the ones concerning complete bases (see Table 3). 

From the derived results, it appears that strategy-proofness is easier to achieve with 
formula-based operators than with model-based ones, especially when the bases are single- 
tons (i.e., with the A*^* operators). This could be explained by the fact that the latter 
operators obey an all-or-nothing principle - a base is either selected as a whole (and in- 
cluded as such in a maxcons) or it is not selected at all - and this may forbid some subtle 
manipulations. 

We have also exhibited some restricted strategies that constrain the agent who wants 
to manipulate. For example, all model-based operators are strategy-proof for dilation. 

Most of the results of this paper are based on three satisfaction indexes, that are, 
according to us, the most natural ones when no additional information about the merging 
process is available. These three indexes share the property that if two bases are jointly 
inconsistent, then the satisfaction is minimal. We call it the consistency property. In 
order to handle scenarios where the consistency property is not discriminant enough, we 
introduced the Dalai index. It turns out that none of the operators considered in the paper 
is strategy-proof for this index. 

The choice of a satisfaction index has (by definition) a major impact on the existence 
of manipulation. As explained before, if the full preferences of all the agents over sets of 
interpretations were available, strategy-proofness could be easily defined as in Social Choice 
Theory: a manipulation occurs if and only if the merged base obtained when the agent lies 
is strictly preferred (w.r.t. her own preference) to the the merged base obtained when she 
reports her "true" base. When such information are not available, several choices for an 
index are possible, capturing different intuitions. 

When beliefs are to be merged, indexes satisfying the consistency property seem more 
suited than the remaining ones; indeed, for the latter indexes, even if a merged base is "close" 
to the agent's beliefs, it is still not compatible with them. Drawing such a conclusion is not 
so easy when goals are to be merged, since for instance, it can be the case that for some 
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Table 4: Synthesis of the results. 
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agents, the more goals satisfied, the better. Nevertheless, our three satisfaction indexes i^^, 
ids and ip are still meaningful in such scenarios, since an agent is typically more satisfied if 
the goals of the group are compatible with her own ones than if it is not the case. 

In light of our study, strategy-proofness appears as a property independent of the com- 
putational complexity of query answering from a merged base (see Konieczny et al., 2004). 
It means that having a low/high complexity does not prevent /imply strategy-proofness. 

Strategy-proofness appears also independent of the fact that the operator satisfies the 
rationality postulates given by Konieczny and Pino Perez (1999, 2002). Indeed, as a direct 
consequence of Theorems 2 and 3, we have that some majority (resp. arbitration) merging 
operators (Konieczny & Pino Perez, 2002) are strategy-proof, while others are not. Thus, 
satisfying the rationality postulates for merging proves not sufficient to ensure strategy- 
proofness or manipulability. Nevertheless, we can note that arbitration operators, like 
^d,GMax^ are more sensitive to manipulation than majority operators, like A*^'^. This is 
easily explained by the fact that arbitration operators are egalitarist ones: they aim at 
giving a result that is close to each base of the profile. Intuitively, a small change in a 
base can heavily change the whole result. Contrastingly, majority operators, that listen to 
majority wishes for defining the merged base, often do not take into account bases that are 
"far" from the majority. So, when using majority operators, it is likely that a small change 
in a base has no impact on the merged base. 

Thus, strategy-proofness can be viewed as a further dimension that can be used to 
compare merging operators, besides the computational complexity and rationality criteria. 
Its independence to the latter criteria may also explain why no strategy-proofness results 
for wide families of operators seem to exist. 

7. Related Work 

As explained through this paper, the manipulation problem has been studied extensively 
in Social Choice Theory for years. In the next subsection we will relate our work to this 
stream of research. In a second subsection we mention some other related work concerning 
the strategy-proofness issue for weighted bases. 

7.1 Social Choice Theory 

In the propositional merging framework considered in the paper, the beliefs/goals K of each 
agent induce a two-strata partition of the interpretations: all the models of K are equally 
preferred, and strictly preferred to its countermodels, which are equally disliked. When 
agents report full preference relations (that can be encoded in various ways, e.g., explicitly, 
or by a prioritized base, an ordinal conditional function, etc.), the aggregation problem 
consists in defining a global preference relation from individual preference relations. This 
problem has been addressed for centuries in Social Choice Theory. This can be traced back 
at least to Condorcet (1785) and Borda (1781). 

In Social Choice Theory (Arrow et al., 2002), the strategy-proofness problem has re- 
ceived great attention. In this framework, an agent A is untruthful when she reports a 
preference relation (a complete pre-order over the set of alternatives) that is not the true 
one. A social choice function (associating an alternative to a profile of such preference 
relations) is not strategy-proof when the alternative chosen by the function when A lies 
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is ranked higher for A than the alternative chosen when she reports her true preferences. 
One of the most famous result in Social Choice Theory is that there is no "good" strategy- 
proof preference aggregation procedure. This result is known as Gibbard-Satterthwaite 
impossibility theorem (Gibbard, 1973; Satterthwaite, 1975; Moulin, 1988). 

Formally, consider a set of agents {individuals) = {1, . . . , n}, and a set of alternatives 
A = {a, b, . . .}. Each agent i has a preference relation on those alternatives, that is supposed 
to be a complete, reflexive and transitive binary relation, noted >j. A preference profile 
P = (>i, . . . , >n) assigns a preference relation to each agent. Let us note *P the set of 
all possible preference profiles. A given preference profile can be noted P = {P^i, >i), 
i £ N, where P-i denotes the profile P without (the preferences of) individual i. A social 
choice function / is a mapping from *P to A social choice function is manipulahle if 
there is an individual i £ N, a preference relation >', and a preference profile P such that 
f{P~i, ^i) >i fiP)i i-e., when there is an agent i that is best satisfied with the result when 
she claims her preferences are > • instead of her true preference >j. If a social choice function 
is not manipulable, it is said to be strategy-proof. A social choice function is dictatorial if 
there is an individual i £ N (the dictator), such that f{P) >i a for all a E ^ and for all 
P G *p. A social choice function is onto if for each alternative a £ A there is a preference 
profile P € ^ such that f{P) = a. Then Gibbard-Satterthwaite theorem (Gibbard, 1973; 
Satterthwaite, 1975) can be stated as: 

Theorem 13 (Gibbard, 1973; Satterthwaite, 1975) If A contains at least three alternati- 
ves, then there is no social choice function f that is onto, strategy-proof and non- dictatorial. 

Since this result has been stated, there has been a lot of work for deriving strategy- 
proofness results under some restrictions (see Kelly, 1988; Arrow et al., 2002). In some 
sense, our work is relevant to such approaches. Nonetheless, our work is original - as far as 
we know - from two points of view: on the one hand, the preference relations considered 
here are two-strata total pre-orders, and not arbitrary pre-orders; on the other hand, the 
result of a merging process is usually not a single interpretation but still a two-strata total 
pre-order (and the number of models of the merged base is not constrained a priori). This 
leads to more complex notions of strategy-proofness where different definitions are possible, 
depending on an index which formalizes one of the various intuitive notions of "how satisfied 
an agent is by the result of the merging process" . 

In social choice theory, there are also some works on social choice correspondences, that 
are mapping from ^ to 2-^, and that are closer to our framework than social choice func- 
tions. The data coming from individuals are preference relations on A., and the problem is 
to shift them to preference relations on 2-^. The standard way to achieve it is to consider 
that even if a set is chosen by the correspondence, then ultimately only one alternative will 
be realized, and to suppose that each individual has a subjective probability measure on 
this realization. Then a social choice correspondance is strategy-proof if it is not possible 
for an individual to increase her expected utility of the result. In this case, results sim- 
ilar to Gibbard-Satterthwaite theorems can be derived (see e.g., Barbera, Dutta, & Sen, 
2001; Chin & Zhou, 2002; Duggan & Schwartz, 2000). These works are related to the one 
conducted in this paper, but they all suppose that each agent makes available not only its 
full preference relation on alternatives under the form of a utility function - typically not 
reducible to a two-strata complete pre-order - but also its subjective probability measure 
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on alternatives. Contrastingly, in this work, the only information coming from each agent 
is the corresponding base, which typically approximates her full preference relation, and is 
of pure ordinal nature. 

7.2 Strategy-Proofness for Weighted-Bases Merging 

A study of strategy-proofness of some merging operators has been carried out by Meyer, 
Ghose, and Chopra (2001). The framework they consider is distinct from the one used 
in our work. On the one hand, agents may report full preference relations (encoded as 
ordinal conditional functions, also called K-functions, see Spohn, 1987). On the other hand, 
the merging operators under consideration escape Gibbard-Satterthwaite theorem since 
Meyer et al. (2001) make a commensurability assumption between the agents' preference 
relations (the same remark applies also to possibilistic base merging as defined by Benferhat, 
Dubois, Kaci, & Prade, 2002). Roughly, this commensurability assumption amounts to 
consider that the weights (or the levels) associated to formulas have the same meaning 
for all the agents, i.e., that a weight 3 for agent 1 is the same that a weight 3 for agent 
2. The commensurability assumption is sensible in many situations, but when dealing 
with agents' preferences, commensurability must be used carefully. For human agents, it 
is commonly accepted in Social Choice Theory that this assumption is very strong. Arrow 
(1963) illustrates this idea by quoting Bentham: 

" This is vain to talk of adding quantities which after the addition will continue 
distinct as they were before, one man's happiness will never he another man's 
happiness: a gain to one man is no gain to another; you might as well pretend 
to add 20 apples to 20 pears..." 

The notion of strategy-proofness and the merging operators of Meyer et al. (2001) and 
Chopra, Ghose, and Meyer (2006) are defined in the framework of ordinal conditional func- 
tions. In this section, we study the corresponding operators in the pure propositional 
framework, i.e., when the profile contains "flat" belief/goal bases, in order to compare them 
with our approach. 

An ordinal conditional function (OCF) k is a total function from the set of interpre- 
tations W to the set of non-negative integers (originally, an OCF maps an interpretation 
to the class of ordinals, and is such that at least one interpretation is mapped to zero, 
but considering integers is sufficient here). Intuitively, the greater the number, the less 
credible the interpretation. To each OCF k one can associate a base Bel{n) defined as 
[Bel^n)] = {(J € W I k{uj) = min^/gyv;(K(a;'))}. The aim of OCF merging operators is, 
from a profile of OCFs E = {ki, . . . , k„} to define an OCF k/\{E) that best represents the 
profile. The operators studied by Meyer et al. (2001) are the following ones: 



• KA^,,(S)(a;) = max«^g£;Ki(w), 



. KA_^(i?)(u;) = | I 
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The straightforward way to translate the framework of propositional merging into or- 
dinal conditional functions is to consider a propositional base as a special case of OCF: a 
propositional base is a two-strata OCF, with the models of the bases having rank and the 
countermodels having rank 1. If we consider only two-strata OCFs Ki and note Ki = Bel{ni) 
and A = Bel{KA), the previous definitions of merging operators give: 

• AmaxiE) = AminiiE) = f\ E Consistent and AmaxiE) = AmimiE) = T otherwise. 

• Ammi (E) = /\E consistent and Amim (E) = \/E otherwise. 

• As{E) = A'^0'^{E). 

The resulting propositional merging opcrcitors ^fjiaxi ^minit ^niin2i Q^nd. -A.^ are quite 
simple and well-known. A^ax (or equivalently Amm2) is the so-called basic merging op- 
erator (in absence of integrity constraints) (Konieczny & Pino Perez, 1999). Amim is the 
1-quota operator defined by Everaere, Konieczny, and Marquis (2005) (without integrity 
constraints). As corresponds to the intersection operator defined by Konieczny (2000). 

All those operators are strategy-proof for our indexes: 

Theorem 14 Amax, Amim, Amin^, and A^ are strategy-proof for i^w , ids and ip. 

Besides those operators, Meyer, Chopra and Ghose also proposed general definitions of 
strategy-proofness for OCF merging. More precisely, they have studied two properties. The 
first one is the (IP) property (Meyer et al., 2001): 

Definition 13 (IP) An OCF merging operator satisfies the (IP) property if and only 
if for every OCF profile E, for every agent i, we have whatever the OCF k 

Muj G W, \k/^{E){ijj) - Ki{uj)\ < \K,A{rep{E, {i}, k){lo) - Ki{uj)\ 

where rep{E, {i}, k) is the profile identical to E except that the OCF Ki is replaced by k. 

Focusing on two-strata OCFs, we say that a merging operator A(= Bel{KA)) is strategy- 
proof for (IP) if and only if ka satisfies the (IP) property for every agent given any profile. 
We have obtained the following characterization: 

Theorem 15 A is strategy-proof for (IP) if and only if for every profile E and every pair 
of bases K and K' : 

• K A -^A{E U {K}) ^ ^A{E U {K'}), and 

• A A(E U {K}) A{E U {K']). 

The second strategy-proofness property that Meyer, Chopra and Ghose have investi- 
gated is (WIP): 
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Definition 14 (WIP) An OCF merging operator ka satisfies the (WIP) property if and 
only if for every profile E, for every agent i, we have whatever the OCF k: 

^ujeV\^\KA{E){uj) - Ki{uj)\ < T,^(zy^\K^{rep{E, {i}, K)(tj) - Ki{uj)\. 

(WIP) is weaker than (IP) in tlie sense tliat if an OCF merging operator ka satisfies 
(IP) for an agent i, then ka satisfies (WIP) for i (but the converse does not always hold). 

Again, focusing on two-strata OCFs, we say that a merging operator A(= Bel{n^)) is 
strategy-proof for (WIP) if and only if ka satisfies the (WIP) property for every agent 
given any profile. 

Let us note the exclusive or operator, i.e., K®K' = {/\K /\K')V /\K A/\K'). 
Then (WIP) can be characterized in our framework by : 

Theorem 16 Let iwip{K, K/\) = #( [ k®\<:/^ ] )+i ■ ^ satisfies the (WIP) property if and only 
if it is strategy-proof for i^ip- 

Note that the "wip index" i^ip is very close to the probabilistic index ip. The proba- 
bilistic index measures the closeness of the merged base to the agent base, whereas the "wip 
index" measures the difference between the merged base and the agent base. 

However, the corresponding notion of strategy-proofness (and a fortiori the one induced 
by (IP)) appears too strong in the pure propositional setting. Consider the following belief 
merging scenario: 

Example 6 Consider K = a and Ki = h.We have l\'^"''^{{K,Ki}) = a A b. If the 
agent gives K' = {a A ->b} instead of K, then the merged base is /S.'^"'^{{K\Ki}) = a. 
Accordingly, this an example of manipulation for (WIP) (i^ip^/S.'^^ '"^ {{K , Ki\)) = \ < 
iu,^p{^''"'^{{K',K^})) = l). 

In this example, the untruthful agent actually manages to change the merged base to 
one which is more similar to her initial base (with respect to iwip)- This is because she is 
not fully satisfied by the merged base equivalent to o A 5 but still strictly prefers her initial 
base {a}, despite the fact that a Ab refines her own beliefs. Accordingly, such an agent 
wants to preserve both her beliefs and her ignorance. In many scenarios when an agent 
participates to a merging process in order to get new information, this is counter-intuitive. 
Chopra et al. (2006) give more general definitions of strategy-proofness, by considering other 
similarity relations. In the propositional case, they all suffer from the same above-mentioned 
drawback. This explains why we did not investigate the strategy-proofness of the purely 
propositional model-based operators and formula-based operators for criteria like (WIP) 
or (IP). 

8. Conclusion 

Investigating the strategy-proofness of merging operators is important from a multi-agent 
perspective whenever some agents can get the information conveyed by the other agents 
participating to the merging process. When strategy-proofness is not guaranteed, it may be 
questioned whether the result of the merging process actually represents the beliefs/goals 
of the group. 
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In this paper, we have drawn the strategy-proofness landscape for many existing merging 
operators, including model-based ones and formula-based ones, both in the general case and 
under several natural restrictions. Strategy-proofness appears as independent of complexity 
and rationality aspects, and can be used as such, as a further criterion to evaluate merging 
operators. All those results have been discussed in Section 6. 

This work calls for a number of perspectives. A first perspective is to identify the com- 
plexity of determining whether a profile can be manipulated by a base given an operator. 
Indeed, using a merging operator that is not strategy-proof is not necessarily harmful if find- 
ing out a strategy is computationally hard. Such a complexity issue has been investigated for 
voting schemes (Conitzer &: Sandholm, 2003; Conitzer, Lang, & Sandholm, 2003; Conitzer 
& Sandholm, 2002a, 2002b) when individual preferences are given explicitly (which is not 
the case in our framework). A first result follows easily from Theorem 11: if the distance d 
between interpretations can be computed in polynomial time in the input size (which is not 
a strong assumption), determining whether a given profile can be manipulated by a base 
for a drastic index given A^' and /i is in Sg. 

In Social Choice Theory, the Gibbard-Sattertwhaite theorem states that every "sensible" 
social choice function is manipulable. Taking into account the fact that the agents are 
tempted to manipulate transforms the aggregation process into a game between agents. 
For ensuring strategy-proofness, it can prove sufficient to build a game where telling the 
truth is an optimal strategy for each agent. How to achieve it is the aim of implementation 
theory (also called mechanism design), see e.g., Maskin & Sjostrom, 2002. A perspective 
is to determine whether building such mechanisms is possible in a belief merging setting in 
order to force the agents to tell the truth. Most of the work on mechanism design assume 
transferable utility, and use payments as part as the process. Importing such ideas in a 
fully qualitative framework surely is a hard task. 

Another interesting perspective is to study the strategy-proofness problem when coali- 
tions are allowed. Instead of considering manipulation by single agents, one can be inter- 
ested in manipulation by coalition of agents who coordinate to improve the result for the 
coalition. See (Meyer et al., 2001; Chopra et al., 2006) for such a definition in a different 
framework. Since manipulation by a single agent is a particular case of manipulation by a 
coalition, and since we have seen that many operators are not strategy-proof for a single 
agent, it is clear that strategy-proofness results for coalitions will be very hard to achieve. 
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Appendix A. Proofs 
Theorem 1 

1. If a merging operator is strategy-proof for ip, then it is strategy-proof for i^w- 

2. Consider a merging operator A that generates only consistent bases.^ If it is strategy- 
proof for ip, then it is strategy-proof for ids- 

Proof: 

1. Assume that A^ is not strategy-proof for idw- Then there exists a profile E, a base 
K, a base K' and an integrity constraint fi s.t. (1) A^(£' U {K}) A K is inconsistent, 
and (2) A^{E U {K'}) A K is consistent. (1) implies that " 

implies that ^^'^[a^'^el^^''^)] ^ ^ Hence, A^ is not strategy-proof for ip. 

2. Assume that A^ is not strategy-proof for i^s- Then there exists a profile E, a base 
K, a base K' and an integrity constraint /i s.t. (1) A.^{E U {A'}) ^ K, and (2) 

A^{E U {K'}) ^ K. (1) implies that *^f(l2f(^u{K}^)\)^^ + 1- (2) implies that 

" ^ ^/^^^ ^ ^^'^^ ^® consistent. Hence, A^ is not strategy- 
proof for ip. 

□ 



Theorem 2 

• Let f he any aggregation function. A.'fP'^ is strategy-proof for ip, i^w end ids- 

• Let d he any distance. Provided that only two hases are to he merged, Ay^ is strategy- 
proof for the indexes i^w CL'^-d ids ■ 

• For any distance d, A^'^ is strategy-proof for the indexes ip, idw o.nd ids when the 
initial hase K is complete. 

Proof: 

• Let / be any aggregation function. Af^^'^ is strategy-proof for ip, idw and ids- 

The proof is organized in three steps: by reduction ad absurdum, we show that the 
minimal drastic distance between a model of fj, and E U {K} is equal to the minimal 
drastic distance between a model of and E U {K'}. Then, it is easy to show that 
the number of K 's models is greater in E\J {K} than in EU {K'}. Finally, we prove 
that the number of countermodels of K is greater in EU {K'} than in EU {K}, which 
entails a contradiction. 

5. I.e., A^(_E) is always consistent. 
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Prom Theorem 1, we know that if any operator A^f"^ is strategy-proof for ip, it is also 
strategy-proof for both idw and ids (indeed, A'f/^'-^{E) is always consistent). So it is 
sufficient to prove the strategy-proofness of A^P'^ for ip to prove its strategy-proofness 
for the three indexes. 

Let us prove it by reductio ad absurdum: assume that there is an operator A'fP'^ , where 
do is the drastic distance and / is any aggregation function, that is not strategy-proof 
for ip. Then there exist an integrity constraint ;U, a profile and two bases K and 
K' s.t. ip{K, A'fr'^{{K} U E)) < ip{K, A'lf'^dK'} U E)), which is equivalent to 

#{[K] n [E A-jF^f K]) ^ #([K] n [E l^'jF'f K']) 
#{[EAfF^f K]) #{[E AfF'f K']) 

where E A'fT'^ K is a light notation for A^°'^({K} U E)). Let us note dmin{E U'jf'^ 
{K}) = min({dD{i^, E U {K}) \ to \= fi}, <). We now show that dminiEu'lf'f {K}) = 
dmin{E U^°'^ {K'}): 

- Let us first notice that we have ip{K, E Af/"'^ K) ^ 1: if ip{K, E A'jf'^ K) = 1, 
then the probabilistic satisfaction index takes its maximal value, so it is impos- 
sible to increase it. 

Since ip(A',^A;i^'^i^) < 1, we have that #{[K]n[EA'^p^^'^ K]) < #{[E A'fP'^ K]), 
so at least one model of E A'fP'^ K does not belong to K: 

3oJi [= {^K)Afi,dD{iOi,EU{K}) = drnin{E uf/^'^ {K}). 

Since wi |= {^K) A /x, we have dD{uJi,K) = 1 and this distance is maximal 
(because we use the drastic distance). We get immediately that dcioJi^K) > 
doi^^i, K'). Hence doiuJi, E\J{K}) > doii-Oi, E\J{K'}) (because the aggregation 
function / satisfy non-deer easingness). Since dD{u>i,E U {K}) = dmin{E uf/^'^ 
{K}), we get dminiEu'fF^^ {K}) > doiuJi^EU {K'}). Since dniuJi.EU {K'}) > 
d,nin{E u;i°'^ {K'}) by definition of min and since uji \= ji, we have 

drmniE uf,^'^ {K}) > dm.in{E uf/^'^ {K'}) (*). 

- We can also conclude that ip{K, E A'fT'^ K') ^ 0: if ip{K, E Af/"'^ K') = 0, then 
ip{K,E A'ff'^ K') is minimal, so the value taken by ip has not increased, and 
this contradicts the assumption (manipulation). 

If ip{K,E A'ff'^ K') 7^ 0, then we can find at least one model oi K /\ ^ m 
EA'fF'^K': 3cui ^ K ^^^,dD{uJl,EU{K'}) = d™„(^U^^'-^{K'}). Since wi ^ K, 
we have dD{uJi,K) = and since this distance is minimal, we get dD{i^i,E U 
{K}) < dDiLOi,EU {K'}), and then ^^(u;!,^ U {K}) < dmUE U'jf'^ {K'}), 
because dDiuJi,EU{K'}) = dn.iniEu'lf'^ {K'}). Furthermore, since du^uji, E U 
{K}) > dmin{E U^^'-^ {K}) by definition of min and because u>i \= fi, we have: 

dmin{E Uf^^'f {K}) < drmniE Uf^^'^ {K'}) (**). 
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From the inequations (*) and (**), we get: 

d^UE Wf^^f {K}) = dmin{E Uf.'^'f {K'}). (1) 

Let us show now that we can only increase the number of countermodels of K in 
E A'jf'^ K', and decrease the number of models of K in E A'jf'-^ K' . 

— Let (J be a countermodel of K which is a model of E A'ff'^ K: uj \= {^K) A 
{E A^^'^ K). 

Since uj \= ^K, we have doi^J^K) = 1 and this distance is maximal. Hence 
dD{io,K) > dD{uJ,K'). So: 

dD{u;,EU{K})>dD{u;,EU{K'}) (2) 

because the aggregation function / satisfies non-decreasingness. 

Since w ^ E Af,""'^ K, we have doiio, E U {K}) = dmin{E uf,""'^ {K}). With (2), 

we get dmin{E U^^'^ {K}) > doioo, E U {K'}). 

Since dn^iniEuf/"^^ {K}) = dmin{Euf,'"^ {K'}) with (1), we obtain: dmin{Ev/°'f 
{K'}) > doioj^E U {K'}). By definition of min and since uj \= ^ (because u; \= 
EA'lf'^ K), we deduce that u; is a model of E A'f^^'^ K' . We can conclude that 
every model of E Af/^'^ K which is not a model of -fC is a model of E Af/^'^ K'. 
Hence: [^K] n [E A'l^'^ K] C [-^K] n [E A'l°'^ K']. 

- Finally, let u; be a model of K which is a model oi E A'fT'^ K' : ^ KA{EA'I,'''^ 
K'). Since u; ^ -fC, we have dD{uj,K) = and this distance is minimal. Hence 
dDiuJ,K) < dD{uj,K'). So: 

dD{uj,EU{K}) <dD{uj,EU{K'}) (3) 

because the aggregation function is non-decreasing. 

Since to \= E A'fP'^ K', we have doiuj, E U {K'}) = dmin{E U^l^'-^ {K'}). With 
(3), we get dD{oo,EU {K} < dmin{E U^°'^ {K'}). Since dmin{E U^°'^ {K}) = 
dminiEuf,'''^ {K'}) with (1), we obtain dD{uJ,EU{K} < dminiEu'f,'''^ {K}). By 
definition of min and since iv ^ /i (because uj ^ E A'fT'^ K'), we deduce that u 
is a model of ^ A;!^'-^ K. We can conclude that every model E A'ff'^ K' which 
is a model of is a model of E A'fP'^ K. It follows that [K] n [E A'f.^'^ K'] C 
[K] n [E A'fT'^ K]. 

Since we can only increase the number of countermodels of -fC in ii^ Af/^'^ K' and 
decrease the number of models of iiT in A'ff'^ K', the proportion of models of K in 
E A'fj^'^ K' is smaller than in E A'ff'^ K . This contradicts the assumption and shows 
that Z^'ff"^ is strategy-proof for ip. 

• Let d be any distance. Provided that only two bases are to be merg ed, A^^ is 
strategy-proof for the indexes i^w and ids- 
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In this proof, we first show that the merging of two bases is consistent with each base. 
Then, the property follows directly. 

Strategy-proofness for the two drastic indexes is a direct consequence of the fohowing 
property: 

Lemma 1 If E = {Ki,K2}, then A^^{E) A Ki and A^^{E) A K2 are consistent. 

Proof: We show that Aj^{E) A Ki is consistent (the remaining case is similar 
by symmetry). Reductio ad absurdum. Let us suppose that for two bases Ki and K2, 
Ay^({A'i, X2}) is inconsistent with Ki. We can deduce that: 

3a;' ^ ^Ki,Vu; ^ Ki,d{u,Ki A'^'^ K2) > d{uj',Ki A"'-^ K2), 

where Ki A^'^ K2 is a hght notation for Ay {{Ki, K2}). 

Since |= Ki,d{uj,Ki) = 0, we get that 3uj' \= -^Ki,Vuj \= Ki,d{LO, K2) > 
d{Lo',Ki) +d{uj',K2). In particular, if we consider uji \= Ki s.t. d{uj',ijji) = d{uj' , Ki) 
(such an uJi exists by definition of d{uj' , Ki)), we have: d{uJi,K2) > d{uj',uji) + 
d{ijj',K2). Similarly, if we consider 0J2 \= K2 s.t. d{uj',uj2) = d{u',K2), we get: 

d{uJl,K2) > d{uj',LL!l) + d{Lj',UJ2) {*)■ 

By definition of d, we have Vu; |= K2, d{uJi,K2) < d{uJi,uj); in particular, d{uJi, K2) < 
d{ijJi,u}2). By transitivity of <, and with (*), we get d{uji,uj2) > d{u;',uji) + (i(w',LJ2)- 
This contradicts the triangular inequality. □ 

Let us now prove the main theorem: 

Weak drastic index . For two bases Ki and K2, we always have idwiKi, Ki Ai^'2) = 1, 
because Ay {{Ki, K2}) AKi is consistent (Lemma 1), so no manipulation is possible 
(idw is maximal). 

Strong drastic index. If A^^ is not strategy-proof, then we can find K[ s.t.: 

ids{Ki,A''^^{{Ki,K2}) < ids(.Ki,A''f{{K[,K2}). 
For the strong drastic index, this means exactly that: 

Af ({iri,i^2})^i^i (4) 

and: 

Af ({Al,K2})N/^i- (5) 

Since Aj^{{K[,K2}) A K2 is consistent (Lemma 1), we can find u)2 \= K2 s.t. UJ2 \= 
A'^^{{K[, K2}). With (5), we can conclude that u!2 \= Ki as well. 

Since we have uj2 \= K1AK2, we can conclude that for every model to of Aj^({Ki, K2}), 
we have d{uj,{Ki,K2}) = 0. So Vw ^ A^^{{Ki,K2}),d{uj,Ki) = d{uj,K2) = 0. 
Hence Vw ^ A'^^{{Ki,K2}),uJ ^ Ki A K2. This contradicts (4), so no manipulation 
is possible. 
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• For any distance A^' is strategy-proof for the indexes ip, i^w and ids when the 
initial base K is complete. 

For the drastic indexes, the result is a consequence of Theorem 11, showing that if a 
manipulation occurs with an initial base K, then a manipulation with a complete base 
\= K is possible. If K is complete, no such manipulation not possible. 

For the probabilistic index, the result is a consequence of the triangular inequality. 

Drastic indexes . The property is a direct consequence of Theorem 11, showing that 
if A^'^ is manipulable for i^w and ids by a base K, then it is manipulable by erosion. 
But manipulation by erosion is impossible whenever K is complete. 

Probabilistic index . By reductio ad absurdum: let us suppose that there is an operator 
^fi^, where d is any distance, that is manipulable for ip given a complete base K = 
{coi}. So, there exists an integrity constraint fi, a profile E, and a base K' s.t.: 

ipiM, A^'^(Vi} U E)) < ipiM, A^'^({A"} U E)). 

If ip{{uji}, Af^^ {{ll!i}UE)) = 0, then z^^dLiJi}, A^'^d^i} U £^)) = too. In that case, 
manipulation for ip implies manipulation for idw and we have seen that no manipula- 
tion is possible for idw As a consequence, we can suppose that ip{{u!i}, A^'^dwi} U 
E)) y^O. Equivalently: 

#a^^}n[EA^ Wi}]) ^ 

#{[EA^M]) ^ 
(where E {f-t^i} is a light notation for A^' ({ciJi} U i?)). 

This statement allows us to infer that wi is a model of E A^ {"^i}- In order to 
increase ip{\LO\\, t^^iK' U £')), we have to reduce the number of models of E A^ K' 
compared to E A^ {"^i}, without removing lo\ from \E A^ K'\. So we have to find 
7^ f^i s.t. u>2 \= E A^ {f^i} and u>2 ^ E A^ K'. So, 0^2 ^ and we have d{u!2, E U 
{uJi}) = d{uJi,E U {wi}) and: d{uJ2,E U {K'}) > d{uJi,E U {K'}) (because lvi is a 
model of both E A^ {^^i} and E A^ K'). With the aggregation function S, we get: 
d{uJ2,iOi) +d{L02,E) = d{uJi,E) and d{uJ2,K') + d{uJ2,E) > d{uJi,K') + d{u)i,E). 

Replacing (i(a;i, E) by d{u)2, u)i)+d{ijJ2, E), we obtain d{u!2, K')+d{u!2, E) > d{u!i, K')+ 
d{u}2,uji) + d{uj2, E), so d{uj2,K') > d{uJi,K') + d{u!2,uJi). If u![ is a model of K' s.t. 
d{uJi,K') = d{uJi,uj'i), then we have d{uj2,K') > d{uJi, uj[) + d{uJ2, ^^i) ■ Furthermore by 
definition of min, we have d(a;2, w'l) > d{uj2,K'), so d{u!2,i^i) > d{uJi,uj[) + (i(u;2, wi) 
which contradicts the triangular inequality. 

□ 

Theorem 3 

• A^^'^ is strategy-proof for idw or ids if md only if (fi = T and i^{E) = 2) or K is 
complete. 

• A^^'^ is strategy-proof for ip if and only if K is complete. 



77 



EVERAERE, KONIECZNY & MARQUIS 



Proof: Theorem 2 entails straightforwardly the <^= part of the proof, taking the 

Hamming distance dn for d. 

For the =^ part of the proof, we shall show by examples of manipulation that A^^'^ is not 
strategy-proof in other cases. 

• The first examples show that A^^'^ is not strategy-proof for i^^ or i^g if (/i ^ T or 
7^ 2), and if K is not complete. 

Weak drastic index . 

— and ^ T [K is not complete) 

We consider the constraint /_f = aV6 and the two bases K\ and K2 defined by their 
set of models: [Ki] = {00,01} and [K2] = {10}. We have [/^'l"'^{{Ki,K2])] = 
{10} and idu,(i^i, A^^'^({i('i, A'2})) = 0. On the other hand, if the agent whose 
base is Ki gives K[, with [K[] = {01} instead of Ki, we obtain [Ml"-^{{K[, 
K2})] = {01, 10, 11} and idni{Ki, Mf,"'^{{K[,K2}) = 1. This example shows the 
manipulability of A^^'^ if // ^ T, even if there are only two bases in the profile. 
Computations are detailed in Table 5. Interpretations that do not satisfy the 
constraint are shaded. 



iU 


dfl- ((^, Ki ) 




K2) 


A^«'^{{i^i,ii-2}) 




00 





1 


1 


1 


2 


01 








2 


2 


2 


10 


1 


2 





1 


2 


11 


1 


1 


1 


2 


2 



Table 5: Manipulability of Mf,"''^ for 

idw with ji . 



— idw and 7^ 2 (i^T is not complete) 

Let us consider the three bases [Ki] = {00, 10}, [K2] = {01, 10, 11} and [K3] = 
{01}. Then A^"'^{{Ki,K2, K3}) has a unique model 01 and A^«'^({is:i, 
K2,K3}) = 0. If we consider now [K[] = {10} instead of Ki, then [A^«'^({i^(, 
K2,K3})] = {01,10,11} and iaUKi, A''h^^{{K[, K2, K^}) = 1. See Table 6. 





Ki 




K2 


K3 






00 





1 


1 


1 


2 


3 


01 


1 


2 








1 


2 


10 











2 


2 


2 


11 


1 


1 





1 


2 


2 



Table 6: Manipulabihty of A^^'^ for i^^ with #{E) / 2. 



Strong drastic index. 

78 



The Strategy-Proofness Landscape of Merging 



— ids ^-iid ^ ^ T {K is not complete) 

We consider the constraint /.t = (a A 6) V (a A -16 A -ic) and the two bases Ki and 
K2 defined by their sets of models: [Ki] = {000, 111} and = {000, 001}. We 

have [A^"'^({i^i,i^2})] = {111,100} and A^"'^({i^i, i^a})) = 0. On the 

other hand, if the agent whose base is Ki gives K[, with [K[] = {111} instead 

of Ku we obtain [A^«'^({i^(, K2})) = {HI} and A^^'^({i^( , K2}) = 1- 

This example shows the manipulability of A^^'^ for if ^ T, even if there 
are only two bases in the profile. Details of the computation are reported in 
Table 7. 





Ki 




K2 






000 





3 








3 


001 


1 


2 





1 


2 


010 


1 


2 


1 


2 


3 


oil 


1 


1 


1 


2 


2 


100 


1 


2 


1 


2 


3 


101 


1 


1 


1 


2 


2 


110 


1 


1 


2 


3 


3 


111 








2 


2 


2 



Table 7: Manipulability of Aj^^'^ for i^j^ with fi ^T. 



— ids and 7^ 2 {K is not complete) 

Let us consider the three bases [Ki] = {000,001,111}, [K2] = {110,001} and 
[K3] = {110,000}. Then [A'^"'^{{Ki, K2, K3})] = {000,001,110} and 

irf,(ifl,Af '^({i^l,K2,i^3}) =0. 

If we consider [K[] = {000,001} instead of Ki, then [Aj"'^{{Ki, K2,K3})] = 
{000,001} and ids{Ki, Aj"'^{{K[, K2, K3}) = 1. See Table 8. 



LU 


Ki 


K[ 


K2 


K3 






000 








1 
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001 
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1 
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010 
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3 


oil 
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1 


1 


2 
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4 


100 


1 


1 


1 


1 


3 


3 


101 


1 


1 


1 


2 


4 


4 


110 


1 


2 








1 


2 


111 





2 


1 


1 


2 


4 



Table 8: Manipulability of A'^»'^ for ids with #(^) 7^ 2. 



• The following example shows that A^^' is not strategy-proof for ip if K is not com- 
plete. Table 9 shows the manipulability of Ay"'^ for ip (even if there are only two bases 
in the profile and if ^ = T). Let us consider the two bases Ki and K2 defined by their 
sets of models: [Ki] = {000,001,010,100} and [K2] = {110,011,101,111}. We have 
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[A^«'^({i^i, K2})] = {001, 010, 100, 110, oil, 101} and ip(A'i, A^^'^({/Ci, K2})) = 5. 
On the other hand, if the agent whose base is Ki gives K[, with [K[] = {000} in- 
stead of i^i, we obtain [A'^'''^{{K[, K2})] = {000,001,010, 100,110, 011,101} and 
i,{K,,A'f'''{{K[,K2}) = l. 









K2 






000 
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001 
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2 


010 
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1 


2 


oil 
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2 
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100 
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101 


1 
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2 


110 
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1 
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111 


2 


3 





2 


3 



Table 9: Manipulability of Aj"'^ for ip if K is not complete. 

□ 



Theorem 4 

• /^'jH^GMax strategy-proof for the satisfaction indexes idw end ip (even if fi = T, 
K is complete and #{E) =2). 

• j\<liH,GMax strategy-proof for the satisfaction index ids if o-n-d only if ^ = T , K is 
complete and i^{E) = 2. 

Proof: 

• Table 10 shows the manipulability of /\'iH,GMax ^^le weak satisfaction index i^w 
even if ^ = T, K is complete and #{E) = 2. We consider Ki s.t. [Ki] = {001}, K2 
with [K2] = {111}, and = T. We have [Af,"'^^^'''' {{Ki, K2})] = {011,101}, so no 
model ofKi belongs to [A'f,"'^^'''''{{K,, K2})] and ia^Ku K2}) = 0. 
If agent 1 gives K[ with [K[] = {000} instead of Ki, then [Aff'^^'''''{K[,K2})] = 
{001,010, 011,100,101,110} and idwiKi, Af,"'^^'^"'' {{K[, K2}) = 1. 





Ki 


K[ 


K2 




Af," i{K[,K2}) 


000 


1 
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(3,1) 


(3,0) 


001 
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(2,0) 


(2,1) 


010 
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2 


(2,2) 


(2,1) 


oil 
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(1,1) 


(2,1) 


100 
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(2,1) 


(2,1) 


101 


1 
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(1,1) 


(2,1) 


110 


3 


2 


1 


(3,1) 


(2,1) 


111 


2 


3 





(2,0) 


(3,0) 



Table 10: Manipulability of ^^w,GAfax £^^, 
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Since manipulability for i^^ holds, manipulability for ip holds as well (cf. Theorem 1). 

• As to ids, we first show that /^'j^^H^GMax strategy-proof for this index if /i = T, 
ij^{E) = 2 and K is complete. Then, we give examples of manipulation if /i ^ T, or 
i^{E) ^ 2, or K is not complete. 

— ^[jff''^*^'^^ strategy-proof when E = {Ki,K2} and /i = T, if Ki is complete. 
We consider E' = {K[,K2} with K[ = K'^^ complete (thanks to the forthcoming 
Lemma 2, we know that if the operator is manipulable, it is manipulable for 
a complete base), and ^ = T. Let #(7^) = n and let d{K[,K2) = m < n. 
Then there exists a model uj2 of K2 s.t. , ^2) = m. By definition of the 
Hamming distance, uj2 can be generated from coi by flipping m variables (since 
K'^_^ and uj2 differ on the truth values of m variables xi, . . . , Xm)- 

If m = 2A: + 1 (m odd), then d{T,E') = (k + l,k); otherwise m = 2k (m 
even) and d{T,E') = {k,k). In the first case (m odd), there exist at least two 
interpretations oo and uj' s.t. d{uj,E') = d{uj',E') = d{T,E') (for instance, uj is 
generated from wi by flipping xi, . . . ,Xk and lo' is generated from uj2 by flipping 

•^fc+l ) • • • ) ^m) • 

A similar conclusion can be derived in the second case (m even) as soon as k > 1 . 
In these two cases, /^'^^'^^^"'■^(^^''j i^^s at least two models, hence we cannot have 
^(iH,GMax ^j^f^^ _ ^ith Ki complete: E cannot be manipulated by Ki for ids- 
The remaining case is d{T, E') = (0, 0). It imposes that K'^^^ A K2 is consistent. 
Since K'^^ is complete, we have /\^'!^'^^^'^^ (^j^'"^ = K'^^, hence no manipulation is 
possible for ids (since /\[|?''^*'^"^(^') = Xi if and only if Ki = K'^_^ if and only if 
'^*^'^"({Ki,i^2}) = i^i). 

— For showing the manipulability for ids, we consider the following scenarios: 

* /U ^ T, even if #(-E') = 2 and K is complete. 

Let us consider [Ki] = {01}, [K2] = {11}, ^JL = ^a^h. Then [/^f,"'^^^"'' {{Ki, 
K2}] = {01, 11}, and ids(i^i, A^«'^^''^"({i^i, K2}) = 0. If agent 1 gives K[ 
with [K[] = {00} instead of Ki, then the result is [/S.'l"'^^''''{{K[,K2})] = 
{01} and fd,(Ki, A^«'^^""({K;,i^2}) = 1. (see Table 11). 









K2 




A^«^^^""^{{i^;,i^2}) 


00 


1 





2 


(2,1) 


(2,0) 


01 





1 


1 


(1,0) 


(1,1) 


10 


2 


1 


1 


(2,1) 


(1,1) 


11 


1 


2 





(1,0) 


(2,0) 



Table 11: Manipulability of A^^' for ids if A* ^ T 



* #(-E^) 7^ 2, even if = T and K is complete. 

Let us consider [Ki] = {01}, [i^2] = {H}, and [iCs] = {00,01,11}. Then 
[A5[«'''*'""({i^i,i^2, i^s}] = {01,11}, so id,(Ki,A!f«'^^'^"({Ki,i^2,i^3}) = 



81 



EVERAERE, KONIECZNY & MARQUIS 



0. If agent 1 gives K[ with [K[] = {00} instead of Ki, then [A7'^^°''({Kj , 
K2,K3})] = {01} and A!f«'^*^'^"({K{ , i^2, i^s}) = 1- (see Table 12). 



u> 


Ki 




K2 


Ka 




A;'«'^"''"({i^j,K2,i<'3}) 


00 


1 





2 





(2,1,0) 


(2,0,0) 


01 
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(1,0,0) 


(1,1,0) 


10 
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1 
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(2,1,1) 


(1,1,1) 


11 


1 


2 








(1,0,0) 


(2,0,0) 



Table 12: Manipulabihty of A^^''"'"''"^ for ids if / 2. 



* is not complete, even if /i = T and #{E) = 2. 

The example given Table 13 shows that manipulation is possible if the ini- 
tial base is not complete. Consider [Ki] = {01, 10}, [K2] = {11}, and fj, = 
T. Then [A^«'^*''^"({i^i, K2}] = {01,10,11}, and ids{K^, A^«'^*''^"({ifi, 
K2}) = 0. If agent 1 gives K[ with [K[] = {00} instead of Ki, then 
j^d«,GMax^^^,^ K2})] = {01,10} and i,,(Ki,A^«'^*'''^"({K(,i^2}) = 1. 
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K[ 




A;i^''^'"""({i^i,ii-2}) 


A^«^^^"""({i^;,i^2}) 


00 
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Table 13: Manipulabihty of A^'"' for i^s if K is not complete. 



□ 



Theorem 5 



A^^, Aj]^'^, A^^, and Aj^^ are not strategy-proof for ip (even if fi = T , K is complete 
and #{E) =2). 



• A^^ is strategy-proof for idw and ids- 

• A^^ is strategy-proof for idw o.'^d ids if o-i^d only if fi = T . 

• A^^ is not strategy-proof for idw and ids (even if fi = T , K is complete and i^{E) =2). 

• is strategy-proof for idw if and only if fi = T or K is complete, and is strategy- 
proof for ids if and only if fj, = T . 

Proof: 
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• We first give an example of manipulation of A^^ for ip, with i^{E) = 2, a complete 
base Ki, and ^ = T. 

Consider E = {Ki,K2}, with Ki = {aAb} and K2 = {^{aAb)}. Then A^'^{E) = T, 
and ip{Ki, Aj^{E)) = i. But if agent 1 gives K[ = {a,b} instead of Ki, then 
A^^{{K[,K2}) = aVb, and ip{Ki, A^^{{K[, K2})) = ^. So E is manipulable by Ki 
for ip. The same example holds for Aj^^. It remains to note now that Aj^ = Aj^ = 
A to conclude the first point of the proof. 

• A^^ is strategy-proof for i^w and i^s- 
Weak drastic index . 

For any K ^ E there are two cases: 

^ K /\ 11 is consistent. Then there is at least one maximal consistent subset M of 
U^ g^ Ki which contains /i and all the formulas of K. So A^^(£'U{/f }) = M\/R 
(where R denotes the disjunction of the other maxcons) is consistent with K Afi. 
So idw{K, A'^^{E U {K})) = 1 and no manipulation is possible. 

— K A is not consistent. Since for any K', we have A^^(£' U {K'})) \= fi, we also 
have idw{K, A^^{E U {K'})) = and no manipulation is possible. 

Strong drastic index. 

By reductio ad absurdum. Assume that A^"^ is not strategy-proof for ids- It means 
that 

3i^s.t. A';;HEU{K})^K, (6) 
3K' s.t. A^^{E U {A''}) ^ K. (7) 

Prom statement (7) we get that VM G MAXCONs(£^ U {K'},^), M \= K. So if we 
consider A^\E U {K'} U {K}), every M' G MAXCONS(-B U {K'} U {K},^) is of the 
form M U {K}, so M' ^ K and A^\E U {K'} U {K}) ^ K {*). 

From statement (6) we get that 3M G maxcons(£; U {K},^), M ^ K. Since M is a 
maximal subset, it means that M A K is not consistent. So if we consider A|^^(£' U 
{K'} U {K}), then M C M', with Af G maxcons(^ U {K'} U {K},;u). So M' A K 
is not consistent. Hence M' K and A|^^(S U {K} U {AT'}) ^ K, which contradicts 
(*)• 

• A^^ is strategy-proof for i^^^ and ids if and only if = T. 
Weak drastic index . 

Since Ay^ = Ay^, it follows immediately from the above proof for A^^ that Aj^ is 
strategy-proof for idw 

For showing that manipulation is possible for A^'^ if /i ^ T, even with two bases and a 
complete initial base Ki, consider the following example: let Ki = {aA6}, K2 = 

= -16 and K[ = {a}. We have A^^{{Ki, K2}) = -'a, which is inconsistent with Ki. 
We also have A^^{{K[, K2}) = T, which is consistent with Ki. 
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Strong drastic index. 

Since Ay^ = Ay^, it follows immediately from the point above that Ay^ is strategy- 
proof for ids- 

For showing that a manipulation is possible for A^^ for ids if ^ ^ T, even with two 
bases and a complete initial base Ki, we consider the following example: let Ki = {aA 
b}, K2 = {-■a}, fi = ^aA-i6 and K[ = {^aAb}. We have A'i;'^{{Ki, K2}) = ^a, hence 
A^3({^^^^2}) ^ Ki. We also have A.^^^ {{K[, K2}) = ±, hence ^.^ji^ {{K[, K2]) h 
Ki. 

• A|^^ is not strategy-proof for i^w and ids (even if = T, K is complete and #(£') = 2). 
Weak drastic index . 

For showing that manipulation is possible for Aj^^ with two bases, a complete ini- 
tial base Ki and /U = T, we consider the following example: let Ki = {a}, K2 = 
{^a, -la A T}, ^ = T and K[ = {o, o A T}. We have A^'^({Ki, i^2}) = hence 
I^^'^{{Ki,K2}) A Ki is not consistent. We also have A^^({i^{ , K2}) = T, hence 
^^'^{{K'i,K2}) A Ki is consistent. 

Strong drastic index. 

For showing that A^^ is not strategy-proof for ids with two bases, a complete initial 
base Ki and ^ = T, consider the following example: let Ki = {a}, K2 = {"■a}, and 
K[ = {0,0 AT}. We have A^^{{Ki,K2}) = T, hence A^4({/fi, K2}) ^ Ki. We also 
have A(ji\{K[,K2]) = a, hence A;;^^^/^^^!) ^ 

• A|^^ is strategy-proof for idw if and only if = T or X is complete, and is strategy- 
proof for ids if and only if = T. 

Weaic drastic index . 

Since Ay^ = Ay^, it follows from the above proof for A|^^ that A^^ is strategy-proof 
for idw if = ~r. 

If the initial base Ki is complete, A|^^ is also strategy-proof. There are two cases: 

— Ki \= 11. Let M = {(j) ^ Uj^g^K I Ki \= (f)}. By construction, M is an element 
of MAXCONS(|Jj^gg K, T). Since Ki \= fj,, M is consistent with n (Ki is a model 
of each of them) . Since we have both Ki \= M and M \= A'^^{E) (by definition 
of the operator), we also have Ki \= A^^{E). Hence A^^{E) A Ki is consistent, 
and this prevents E from being manipulable by Ki for idw given A^^ and fi. 

— Ki \= ^ji. By definition of the operator, for any base K'^ and any profile E' 
(especially the profile obtained by removing Ki from E), we have A^^{{K[}UE') 
is consistent and A'^^{{K[} U E') ^ /i. This implies that A'^^{{K[} U E') A Ki 
is inconsistent, and no manipulation is possible for idw 

For showing that manipulation is possible for A^^ if ^ T and if the initial base Ki 
is not complete, we consider the following example: 
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let Ki = {a}, K2 = {6, -a}, = ^aV^6 and K[ = {a^^b}. We have ^.^^{{Kl,K2}) = 
b A -la, hence A^^({/fi, K2}) A Ki is not consistent. We also have /S.^^{{K[,K2]) = 
{a A ^6) V (6 A ^a), hence A^4({i^( , i^a}) A is consistent. 
Strong drastic index. 

Since Ay^ = Ay^, it follows immediately from the above proof for A^"*^ that A^^ is 
strategy-proof for ids if /i ^ T. 

For showing that manipulation is possible for A^^ if /i ^ T, even with two bases 
and a complete initial base Ki, we consider the following example: let Ki = {a A 6}, 
K2 = {^b}, fi = a and K[ = {a Ab,by ^a}. We have A'^^{{Ki, K2}) = a, hence 
A^^{{Ki,K2}) y= Ki. We also have A^^{{K[,K2}) = aAb. Hence A'^^{{K[, K2}) \= 

□ 

Theorem 6 

• A^^ is strategy-proof for idw mdins, o-nd is strategy-proof for ip if and only if^{E) = 
2. 

• A^'^ is strategy-proof for i^w CL^d ids if o^nd only if j^i = T , and is strategy-proof for ip 
if and only if = 2 and /i = T. 

• A|^^ is strategy-proof for ip, idw and ids- 

• A^^ is strategy-proof for idw if C'^'d only if if{E) = 2 or fj. = T or K is complete. 

A'^^ is strategy-proof for ids if C'^'d only if #{E) = 2 or = T. Finally, A^^ is 
strategy-proof for ip if and only if jf{E) = 2. 

Proof: 

• A^^ is strategy-proof for idw and ids, and is strategy-proof for ip if and only if = 
2. 

Drastic indexes . The strategy-proofness of A^^ comes from the strategy-proofness of 
A^^ as reported in Theorem 5, because A^^ is a specialization of A^^. Furthermore, 
in the examples given in the proof of Theorem 5 concerning A^^, every base is a 

singleton, so these examples hold for A^^ too. 
Probabilistic index . 

The proof for the probabilistic index and a profile E s.t. =2 is based on the fact 

that the merging of two bases with Aj^^ is either the conjunction of the two bases, or 
their disjunction. In both cases, we shall show that no manipulation can occur. 

For the <^= part of the proof, suppose that i^{E) = 2. we shall show that A^^ and 

A|^^ (we group here the two cases, because their proofs are similar) is strategy-proof 
for ip. By case analysis: 
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If Ki is consistent with ^, then there are two cases: 

* Af^^{{Ki,K2}) = A^5({Ki, K2}) = A'l A A /i if it is consistent. 

* Afi({iri, K2}) = A^^{{Ki,K2}) = [Ki V K2) A otherwise. 

In the first case, A^^{{Ki,K2}) \= Ki and A^^{{Ki,K2}) \= Ki so ip takes its 
maximal value, and no manipulation is possible. 

Let us consider the second case for A^^ (the case for A^^ is similar) : we assume 
that Af\{KuK2}) = {Ki V K2) A fi. 

Since for every base K[, the definition of A^^ requires that we have A'j^^{{K[, 

K2}) \= fJ' and since we have Ki A /i [= A^^({/^i, K2}), the following inequation 
holds for every base K[: 

#{[K,] n [Af\{K[,K2m < #([Ki] n [Af ({A\,i^2})]). 

If K[ A K2 A is consistent, then A'i;^{{K[, K2}) = K[ A K2 A fi, hence 

i^{[Ki]n[A'^^{{K[, ^2})]) = is minimal since we have assumed that KiAK2Afi 
is inconsistent. 

If K[ A K2 A /u is inconsistent, then there are two cases: 

* K'l A/i is inconsistent and K2 A/i is inconsistent. We have A'^^[{K']^, K2}) = 

/U. Since we have assumed Ki A fi consistent, we also have A^^d^Ti, K2}) = 
Ki A fi. Hence: 



and 

ip{Ki,A\l\{Ki,K2})) 



({Kl,A2})) = ^^^^-^^, 



Since the numerators of the two fractions coincide while #([Ari A/i]) < #([//]), 
no manipulation is possible in this case. 

Ar( A // is consistent or K2 A fi is consistent. We have A'^^{{K[, K2}) = 
{K'l V A2) A /i. Since Ki A K2 A /i is inconsistent, we have 



ip{K,,A<-^\{K[,K2})) 



- - #{[iK[VK2)Af,]y 
We also have: 

''^""'^^^ ({^i'^2»)-#([(A',VA2)A/.])- 

Now, since K[ A K2 A fj, is inconsistent, we have #{[{K[ V K2) A fj]) = 
i^{[K[ A n]) + #i[K2 A ij]). Similarly, since Ki A K2 A fi is inconsistent, we 
have #([(A'i V A2) A //]) = #([Ai A /i]) + #([A:2 A /i]). Subsequently, suppose 
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that we have ip{Ki, Af^^{{K[, K2})) > ip{Ki, A'^^{{Ki, K2})). This is the 
case if and only if #{[K^ A K[ A ^#{[^1 A ^A) + #{[K2 A > A 

A^])+#([E:2A/i])). 
If we note a = i^{[Ki A K[ A fi]) and b = #([i^2 A ^]), then there exist two 
natural integers a' and a" such that A ^]) = a + a' and #{[K[ A /i]) = 

a + a" . Replacing in the previous inequation, it comes: 

a{a + a' + 6) > (a + a'){a + a" + b) 

which simplifies to > aa" + a'a" + a'c, which is impossible. Hence no 
manipulation is possible in this case as well. 

— If Ki is not consistent with fi, then, since Vi?', A^"'^(£") \= ^ and /\'^^{E') \= n, 

we have: ^E', ip{Ki, A|^^(£")) = and ip{Ki, A^^{E')) = 0, so no manipulation 
is possible. 

For the part of the proof, the following example shows that strategy-proofness 
for ip does not hold any longer for A^^ or A^^ when 7^ 2, even if the ini- 

tial base is complete and /.t = T. We consider Ki = {a A b},K2 = {a A b} and 
= {-■a}, with the integrity constraint /i = T. There are two maximal consis- 
tent sets in MAXCONs({ifi, ^2, i^s}, /i): Mi = {a A b,T} and M2 = {-■a,T}. Hence 
A^\{KuK2,K3}) = (aA6) V(-a). We get ip{Ki, Af\{K^, K2, Ks})) = i. If 
agent 1 gives K[ = {-la A 6} instead of Ki, then there are two maximal consis- 
tent sets M[ = {a A b,T},M2 = {^a A b,^a,T} in MAXCOm{{K[, K2, K3}, fi), so 
A^\{K[,K2,Ks}) = (a A 6) V (-a A 6).JVe get ip{K,, A^\{K[, K2, Ks})) = i, so 
this is an example of manipulation of Aj^ for ip. 

Since Ay^ = Aj^, this example shows the manipulability of A^^ as well. 

• A^^ is strategy-proof for i^w and ids if and only if /i = T, and is strategy-proof for ip 
if and only if #{E) = 2 and /n = T. 

Drastic indexes . 

Since Ay"^ is strategy-proof for i^^^ and ids 1 its specialization A^'^ is also strategy-proof 
for idw and ids- 

In the example showing the manipulation for A^^ with two bases and a complete 
initial base Ki , every base is a singleton, so this example holds for A^'^ too. 
Probabilistic index . 

Since Ay^ = Ay^, it follows immediately from the above proof for A^^ that Ay^ is 
strategy-proof for ip when two bases are considered, and it is not the case when three 
agents or more are taken into account. 

For showing that manipulation is possible for A^^ with two bases and a complete ini- 
tial base Ki, when the integrity constraint /i is not true, consider the following exam- 
ple: let Ki = {aA b}, K2 = {-a}, ^l = ^b and K[ = {a}. We have A^({i^i, K2}) = 
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-la, which is inconsistent with Ki, so ip{Ki, A^^{{Ki, K2})) = 0. We also have 
A'^^{{K[,K2}) = T, which is consistent with Ki, so ip{Ki, Af^^{{K[, K2})) > 0. 

• A^^ is strategy-proof for ip, idw and ids- This is a direct consequence of Remark 1 
and Theorem 2. 

• A^^ is strategy-proof for if and only if = 2 or = T or is complete. 

A^^ is strategy-proof for i^s if and only if = 2 or = T. Finally, A^^ is 

strategy-proof for ip if and only if #{E) = 2. 

Weak drastic index . 

As A^^ is strategy-proof for ip with two bases, it is also strategy-proof for i^w in that 
case. 

Since Ay^ is strategy-proof for idw, we have that A'^^y is also strategy-proof for idw 
Finally, as no manipulation is possible for A^^ when the initial base Ki is complete 
(Theorem 5), no manipulation exists for A^^ in this cas. 

Contrastingly, a manipulation example exists for A^^ if #{E) ^ 2 and /.i ^ T 
and the initial base Ki not complete. We consider the three (singleton) bases: 
Ki = {b}, K2 = {^a}, K3 = {a A ^6}, and fi = a. We have Af^{{Ki, K2, K3}) = 
aA^b, so idUKi,A^^{{Ki,K2,K3})) = 0. And with K[ = {6 A a}, we have 
AfmK[,K2,Ks}) = a, and idUKi, Af^{{K[, K2, Ks})) = 1. 
Strong drastic index. 

As Aj^ is strategy-proof for ids, Aj^ is also strategy-proof for ids. 

As A^^ is strategy-proof for ip when there are two bases in E, Aj^^ is also strategy- 
proof for ids in this case, since for any profile E, A'^^{E) is consistent. 

A manipulation example exists for A^^ if i^{E) 7^ 2 and ^ T, even if the initial 
base Ki is complete: Ki = {a A b}, K2 = {a A 6}, = {-la V -16}, and fi = a. 
There are two maximal consistent sets in maxcons{{Ki, K2, K-^},T): Mi = {a A 6} 
and M2 = {^a V ^6}. Hence A^^{{Ki, K2, K3}) = (a A 6) V (a A ^b). We get 

ids{Ki, A^^{{Ki, K2, K3})) = 0. With K[ = {^a A ^6}, there are two maximal 
consistent sets in MAXCONs({Eri, K2, -fCs}, T): M( = {a A b} and = {^a A ^b}. 
Hence A^^{{K[, K2, K3}) = (a A 6), and ids{Ki, A^^{K[, K2, K^})) = 1. 
Probabilistic index . 

The proof for A^^ is similar to the proof for A^^ . 

□ 

Theorem 7 The strategy-proofness results reported in Table I4 hold, under the restriction 
that each base is complete (f stands for any aggregation function, and d for any distance). 
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/ is any aggregation function, d is any distance, sp means "strategy-proof'' , 'sp means "non 
strategy-proof" even if ^[E) = 2 and = T, 'sp* means "non strategy-proof" even if either 
i^{E) =2 or fj, = T , but "strategy-proof" if both = 2 and ^ = T. Finally, sp^ means 

"non strategy-proof" even if #{E) = 2, but "strategy-proof" whenever // = T. 



A 


ip 




ids 




sp 


sp 


sp 




sp 


sp 


sp 


\du,GAl ax 
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Af 


sp 


sp 
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Table 14: Strategy-proofness: complete bases. 

Proof: The first line of the table (A^^'-^) is a direct consequence of Theorem 2. 

The second line of the table (A^'^) is a direct consequence of Theorem 2. 

The third line of the table (^i^'jafiMax-^ comes from the proof of Theorem 4. 

The first column of the fourth line (A|^^ and ip) comes from the following example. Let 
Ki = {a, 6}, K2 = {-a, ^6}, K[ = {a^ b} and = T. We have A^^{{Ki,K2}) = T, hence 
ip{Ki,A'^^{{Ki,K2})) = I, while we have A'j;^{{K[, K2}) = (a A V (^a A ^6), showing 
that ip{Ki, A'^^ {{K[, K2})) = ^. The rightmost columns of the fourth line (A^^ and idw, 
ids) come directly from Theorem 5. 

The first column of the fifth line (A^^ and ip) comes from the first column of the fourth 
line given that the example is s.t. /i = T (in that case both operators coincide). Similarly 
for the second and the third columns (A^^ and i^w^ ids) in the case fi = T (Ay^ coincides 
with Aj^). In the remaining case, A^"^ is not strategy-proof for i^w even if i^{E) = 2 as 
the following example shows: take E = {Ki, K2} with Ki = {a A 5 A c}, K2 = {^a A -16, c} 
and fi = -16; we have A|^^(£') = -la A -ib A c, which is inconsistent with Ki; if the agent 
gives K[ = {a,b A -ic} instead of Ki, we obtain A^^({iC(, K2}) = (a A c) V {^a A^b Ac), 
which is consistent with Ki. Finally, A^^ is not strategy-proof for ids even if #{E) = 2 
when fi ^ T; let Ki = {a, -16}, K2 = {^a,b}, K[ = {a A -16} and /i = -^b. We have 
A'^^{{Ki,K2}) = {aA ^b) V {^a A ^b), hence ids{Ki, A'f;^{{Ki, K2})) = 0, while we have 
A^^{{K[,K2}) = aA^b, showing that ids{Ki, A'^^UKi, K2})) = I. 

The sixth line (A?*^) comes from the proof of Theorem 5. 
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The first column of the seventh hne (A|^^ and ip) comes from the first column of the fourth 
line given that the example is s.t. = T (in that case both operators coincide). The second 
column (A^^ and idw) comes directly from Theorem 5. The third column (A^^ and ids) in 
the case /i = T comes from the third column of the fourth line (Ay^ coincides with Ay^). 
Finally, A|^^ is not strategy-proof for i^s even if #{E) = 2 when /x ^ T; let Ki = {a,-ib}, 
K2 = {-a, b}, K[ = {aA -^b} and fi = ^6. We have A^^{{Ki,K2}) = (a A ^6) V {^a A -^b), 
hence idsiKi, A'^j^ {{Ki, K2})) = 0, while we have A'^^{{K[, K2}) = a A -.6, showing that 
ids{Ki,A'^^{{K[,K2})) = l. 

Finally, it remains to consider the A^ operators. As to A^^, we know from Theorem 6 that 
it is strategy-proof for ip (hence for idw and ids) since A^^ is strategy-proof for ip when all 

bases are singletons. Let us focus on A^^, A|^'^ and A^^. Since each base is complete and 
can be assumed to be a singleton without loss of generality, we have 

n 

A^\{Ki,. . . , Kn}) = Af ({/fi, . . . , Kn}) = {\l K,)h^L if consistent, 

i=l 

Af{{Ku . . . ,i^n}) = ^f{{Ki, ...,Kn})=^i Otherwise. 

We also have: 

n 

AJ^({Ki, . . . , Kn}) = ( V K.i) consistent, 

i=l 

A^^{{Ki,. . . , Kn}) = -L otherwise. 
Let A^ be any operator among A^"*^, A^'^ and A^^. There are two cases: 

• A^ consistent. There are again two cases: 

— Ki \= -ifi. Since for every profile E' we have A'^^{E') \= ^ and A^^(£") |= /i, 

we also have A^^{E') f\Ki inconsistent and A^^{E') AKi inconsistent, showing 
that no manipulation is possible for ip, hence for idw and ids- In the specific case 
we consider (all bases are singletons and are complete), we also have for every 
profile E', A^^{E') \= ^ since each base from E' that is kept as an element from 
MAXCONS(£'', T) must satisfy /.t and if no base is kept, A^^{E') is inconsistent, 
hence A^'^(£") |= /i trivially holds. The previous argument can be used to show 
that no manipulation is possible with A^^ for ip, hence for idw (and ids under 
the assumption A^^(£') consistent). 

- Ki \= II. We necessarily have #([-ftri] n [A^({Ki, . . . ,Kn})]) = 1. By reductio 
ad absurdum. A manipulation for ip is possible only if we can find a complete 
base K[ s.t. (1) K, ^ Af:{{K[, . . . , K,}) and (2) #{[A^{{K[, K^})]) < 

#{[A^{{Ki,... ,Kn})]). (2) requires that K[ \= ^^i. (1) imposes that Ki \= 
K[V K2y ...y Kn. Since Ki \= fi while K[ \= ^/i, we have Ki ^ K[. Sub- 
sequently, there exists Kj {j G 2, . . . ,n) s.t. Ki = Kj. Since Kj is a model of 
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A'^{{K[, . . . , Kn}), inequation (2) cannot be satisfied. Hence, is strategy- 
proof for ip, hence for i^^. Since A^(E) is assumed consistent, no manipulation 
is possible for i^s- 

• A'^{E) inconsistent. This is only possible for = A^'^ and requires that each Ki 

(z G 1, . . . , n) is s.t. Ki \= -i/i. Since A^^{E) is inconsistent, we have ip{Ki, A'j^^{E)) = 

0. Since for every K[ complete, Ki is not a model of A^^{{K[, . . . ,Kn}), we have 

ip{Ki, A'^'^iA^^dK'-^^,. . . , Kn}))) = as weh. This shows that A^^ is strategy-proof 

for ip, hence for i^w Finally, when A^^{E) is inconsistent, we have A'^^{E) \= Ki, 
showing that no manipulation is possible for as well. 

□ 

Theorems None of A'jf'^ , /^'jf''^'^'"-^ ^ Aff'^ or A^^''^^-'""' is strategy-proof for i Dalai, 
even in the restricted case E consists of two complete bases. 

Proof: 

• A'lf'^ = /\'lD,GMa._ consider [Ki] = {000}, [K2] = {110} and = a A 6 A c 
where V = {a,6,c}. We have [A^^'^({i^i, A's})] = {110} and iDaia/(i^i, A^°'^({i^i, 
K2})) = 1 - |. With [K[] = {001}, we get [A^^'^({i^{ , K2})] = {110,001} and 
iDaiai{Ki, A'fP'^ {{K[, K2})) = 1 — ^, showing the manipulation (details are reported 
in Table 15). 
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Table 15: Manipulation of A^t^'^ for ioalal with two complete bases. 

• A'l"'^. Let us consider [Ki] = {000}, [^2] = {110} and /i = ^((^a A ^6 A ^c) V (^a A 
6 A^c) V(a A^feA^c)) where V = {a,6,c}. We have [A'l"''^{{Ki,K2})] = {110} and 
iDaiai{Ki,A'l"'^{{K^,K2})) = 1-|. With [K[] = {001}, we get [A^«'^({i^(, i^a})] = 
{110,001,011,111} and iDaiai{Ki,A'l"'^{{K[,K2])) = 1 - 5, showing the manipula- 
tion (details are reported in Table 16). 

• A;l^''^""^ Let us consider [Ki] = {0001}, [i^2] = {0111} and ^^i = (^a A ^6 A 

A -^d) V (^a A 6 A c) V (a A ^6 A ^c) V (a A ^6 A c A ^d) V (o A 6 A A ^d) V 
(a A 6 A c A d) where V = {a,5,c,d}. We have [A;i«'^"""({Ki, ^^2})] = {0111} and 
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Table 16: Manipulation of A^^'^ for ioaiai with two complete bases. 

iDaiai{Ki,^i"^^''--{{Ki,K2})) = With [K[] = {1000}, we get [A^«'^^^»-({J^(, 

K2})] = {0000,0110,1001,1010,1100,1111} and iDaiai{Ki,/\'l"'^"^^{{K[,K2})) = 
1 — showing the manipulation (details are reported in Table 17). 
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Table 17: Manipulation of ^,''H,^Max 

i Dalai with two Complete bases. 

□ 

Theorem 9 None of the operators (hence, none of the operators ) is strategy-proof 
for i Dalai, even in the restricted case E consists of two complete bases. 

Proof: Let us consider the complete bases Ki = {aA b} and K2 = {^a A -16}, with fi = 
-■(aA6). We have MAXCONS({i^i,K2},/i) = {{^aA-i6, ^(aA6)}} = MAXCONScard({-?^i, ^2}, 
/i) and MAXCONS({-fsri,i^2}, T) = {{-.a A -ife, T}, {a A 6, T}}, hence A^^({A'i, A'2}) = 
Ap({A:i,i^2}) = Af ({A:i,K2}) = AfH{K,,K2}) ^ -a A ^6. 
We get inaiai{Ki,A<^{{K^,K2})) = 1 - | = 0. 

With K[ = {-laAft}, we have maxcons({A'( , K2}, /^) = {{^a A^b,-:{a Ab)}, {^a Ab,-:{a A 
b)}} = MAXCOmcard{{K[,K2}, ^i) and MAXCONS({Ar{, i^2}, T) = {{^a A -ift, T}, {-.a A 
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b,T}}, hence Af,H{K[,K2}) ^ A'^^^K'^K^}) ^ A'^^{{K[, K^}) ^ A<^'{{K[, K^}) ^ 
(-■a A -16) V (^a A 6) = -.a. 

Thus iDalal{Ki, ^^({-^1) -^'2})) = 1 ~ 5) showing the manipulation. □ 

d f 

Theorem 10 Let d be a pseudo-distance and let f be an aggregation function. A^''' is 
dilation strategy-proof for the indexes ip, i^w (^nd i^s- 

Proof: The idea is that if the untruthful base K' contains all the models of the "true" 
base K , then the merged base when K' is provided contains at most the same models of K 
as those appearing in the merged base when K is reported, and more countermodels of K. 
So no manipulation is possible. 

From Theorem 1, it is sufficient to show that AJ^'-'^ is strategy-proof for ip. By reductio ad 
absurdum. Let us suppose that there is an operator A^''^, where d and / are respectively a 
pseudo-distance and an aggregation function, which is manipulable by dilation for ip. Under 
this assumption, we can find an integrity constraint fi, a profile i?, two bases K and K' 
with K ^ K', s.t. ip{K, /^'fl^ {{K} U E)) < ip{K, Af;-f{{K'} U E)). Using the light notation 
E Af,K instead of Af,'-!^ {{K} UE),we have: 

#{[K] n [E A^ K]) #{[K] n [E A, K']) 
#{[EA,K]) #{[EA^K']) ■ 

Since K \= K', for any pseudo-distance d, we have Vuj € W, d{uj, K) > d{uj, K'). So, for any 
aggregation function / (that satisfies non-decreasingness) : 

^uj ^W,d{uj,EU{K]) >d{u,EU{K'}). (8) 

Let us note dmin{E {K}) = min{{d{u;,E U {K}) \ uj \= /i},<). With (8), we can 
immediately infer: dmin{E {K}) > dminiE {K'})- Two cases have to be considered: 

. d^i,,{E {K}) > dmin{E {K'}) (*). 

If uJi is a model oi K f\ ^ then, since K \= K', d{uJi,K) = d{uji, K') = 0, so c?(cji, E U 
{K}) = d{uJi,E U {A"}) . If furthermore uJi is a model of E A^ K', then d{uJi,E U 
{K']) = dmin{E {K'}), and d{LJi,EU {K}) = dmin{E {K'}). By definition of 
min, we have d{uji, E\J{K}) > dmin{E\J^{K}), because uji \= fi. So we can conclude 
that dminiE {K}) < dmin{E {K'}), but this contradicts (*). So, no model of 
K f\ a model of E A^ K' . Consequently, ip{K, E K') = and is minimal, and 
this prevents from any manipulation for A^'-^. So, we can exclude case (*). 

. dminiE {K}) = dminiE {K'}) (**). 

If w is a model of E A^ K, then we have both uj \= fi and diuj, E U {K}) = dminiE 
{K}). So, diuj,EU {K}) = dminiE {K'}) with the equation (**). Furthermore, 
with the inequation (8), we infer that diuj,E U {K}) > diuj,E U {K'}). Hence, 
diuj, E U {K'}) < dminiE {K'}). Since u; is a model of /i, we can finally infer that 
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w is a model of E K' as well. So we have that any model of E is a model of 

E Af,K', and then: 

#{[EA^K])<#{[EA^K']). (9) 

We can deduce as well that any model of E A^ K which is a model of ii' A is a model 
of ^ A^ K' (and of K), so: 



n [E A^ K]) < #i[K] n [E A^ K']). 
Furthermore, if cji ^ A' A is a model of A^j K', then we have both: 

- diu;i,E U {i^'}) = dminiE {A"}) = d™„(A {A}) with (**), and 

- d{oJi,EU{K}) = d{oJi,EU{K'}) because K \= A': since d{uJi,K) = 0, we have 
d{uJi,K') = too. 

We obtain: d{uji,E\J{K}) = (imm( A U^{ A'}) and wi \= fJ,, so cJi is a model of A A^ A'. 
Then we can state #([A] n [A A^ A]) > #([A:] n [A A^ AT']). So we get: 



#{[K] n [A A^ A]) = #([A] n [A A^ A']). (10) 
With (9) and (10), we get immediately that: 

#i[K] n [A A^ K]) #([A] n #([A A^ K']) 

#{[EA,K]) - #{[EA,K']) ■ ^ > 



As a consequence, ip{K , A'fl^ {{K} U A) > Zp(A', Aj^'-^dA'} U A)). This inequation 
shows that A'fi^ is not manipulable for ip, which contradicts the assumption. So case 
(**) has to be excluded as well, and this concludes the proof. 



□ 



Theorem 11 Let d he any distance. If Af^^ is not strategy-proof for the index i^w (resp. 
ids), then it is not erosion strategy-proof for idw (resp. ids)- 

Proof: We first need the following lemma: 

Lemma 2 Let d be a pseudo-distance and let f be an aggregation function. If a profile A 
is manipulable by K for idw (resp. ids) given A'fi^ and then one can find a complete base 
K' - the base the agent gives instead of her true base A - s.t. idw{K^ ^niE U {A'})) > 
idu,{K, A^(A U {K})) (resp. ids{K, A^(A U {A'})) > ids{K, A^(A U {A}));. 

Proof: This lemma is mainly a consequence of the definition of the distance between an 
interpretation and a base K' , as the minimal distance between an interpretation and a model 
ijj" of the base; the complete base whose unique model is uj" allows as well a manipulation 

Weak drastic index. 
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We suppose that A^'-^ is manipulable for i^i^, i.e., we can find an integrity constraint n, a 
profile E = {Ki, . . . , Kn}, and two bases K and K' s.t.: 

iUK,A';:f{{K}UE))<i,UK,A';:f{{K'}UE)). (12) 

This is equivalent to: idw{K, E Af,K) = and idw{K, E K') = 1, where Af,'^ {{K} U E) 
is noted E A^ K for simplifying notations. 

Statement (13) states that idw{K, E A^ K) = 0: no model of X A /i is a model of E A^ K; 
statement (14) states that iciw{K,E A^ K') = 1: there is as least one model of K A // in 
E A^ K': 

Vw ^ K A /i, 3lo' ^ i^K) A n, d{J, E U {K}) < d{uj, E U {K}). (13) 
3cJi ^KA/i,Vcj ^/i,d(cJi,^U{K'}) <d{uj,EU{K'}). (14) 
Since in (13) the choice of to' can be made apart from to, (13) is equivalent to: 

3uj' \= {^K) Afiyuj^ K An, d{J, E U {K]) < d(cj, E U {K]). (15) 

Let ^ /C' s.t. d{uJi,K') = d{uJi,uj"). We consider the complete base K" s.t. [i^"] = {uj"}. 
we shall show in the rest of the proof that A^'-^ is manipulable with that base. If the agent 
whose beliefs/goals are K gives K" as a base instead of K, then, since d{u!i, K") = d(u;i, K'), 
we have: 

d{uJi,EU{K"}) = d{uJi,EU{K'}), (16) 

and then: 

yuj\= n, d{uJi , E U {K"}) <d{uj,EU{K'}), (17) 

with (14) and (16). 

Furthermore, since the aggregation function / is non-decreasing (by definition) and since 
K" \= K', we have Vu; \= n, d{uj, E U {K'}) < d{u), E U {K"}), so we get immediately with 
(17): 

Vw ^/i : d{uJi,EU{K"}) < d{uj,EU{K"}). (18) 

So uji is a model of A'fl^ [E U {K"}), and we have idw{K, Afl^ {{K"} lA E)) = I and 
idw{K,/\'fl^ {{K] U ^)) < idwiK.Afl^ {{K"} U S)). This shows that A^'-'' is manipulable 
for a complete base K" . 

Strong drastic index. Let us assume that an operator A^'-^, where d is any pseudo-distance 
and / any aggregation function, is manipulable for the strong drastic index i^^.Then we 
can find an integrity constraint /i, a profile E and bases K and K' s.t. ids{K, A'f^^ {E U 
{K}) < ids{K,A'f,'f{E U {K'}). This implies that ids{K, Af^^ {E U {K}) = 0, and ids{K, 
Af.'^iE U {K'}) = 1. This means, by definition of the index, that Af,'-'' {E U {K}) ^ K, and 
A''/{EU{K'})^K. 

Given a model of A'f^^ {E U {/^C'}) and a model u;2 of /C' s.t. d{uJi,K') = d{uji,uj2), 
we define K" = {^2}- Then we have d{uji,K") = d{oJi,K'), and: d{oJi,EU {K"}) = 
d{oJi,EU{K'}). 
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Let US note dmin{E U^'-^ {K'}) = min{{d{uj, E U {K'}) \ uj \= /i}, <). Since oJi is a model of 
A;!'-^ {E U {K']), we have d{uJi,E U {i^'}) = d™„(^ u;!'^ {i^'}). Hence: 

d{u:i,E U {K"}) = Wf^f {K'}). (19) 

By definition of min and since wi \= fi, we also have: d{uji, E\J{K"}) > dmin{E\jfil'^ {K"}). 
So we get: 

d^in{E W"/ {K'}) > dmin{E W"/ {K"}). (20) 

On the other hand, since K" \= K' , we have: Vw G W,d{uj,K') < d{uj,K"). Since the 
aggregation function / is non-decreasing, we get: 

€ W,d{uj,EU{K'}) < d{uj,EU{K"}), (21) 

and then dmin{E U^'^ {K'}) < d^^E uf,'^ {!<"}). With (20) we get dmin{E U^'^ {K'}) = 
dminiEuf,'^ {K"}). Then, with (19), we obtain d{LOi, EU{K"}) = dnUniEuf,'-'^ {K"}). Since 
cji 1= /i, we have that ui is a model of Afi'^{E U {K"}) too. 

Let a; be a model of Af,'^ {ELi{K"}). Then, w ^ /i and (i(Lj, £;u{ir"}) = dminiEu'f,'^ {K"}). 

Then, since d„i„(£; U^'^ {K'}) = d™„(^ U^'-^ {K"}), we have (i(u;, ^ U {7^"}) = d™„(^U^'^ 
{i^'}). With (21), we get d{uj, E U {K'}) < dmUE u'fl^ {K'}). 

Then, by definition of min we have d{ijj, E U {K'}) = dmin{E U^'-^ {K'}). 

This implies that a; is a model of A'fl^ {E U {K'}) too (because u; ^ /i), so we can write: 
A;i'^(^ U {K"}) [= Af^^iE U {K'}). Since we have A;i'-^(^ U {K'}) ^ K, we can infer that 
A^'^(^ U {K"}) ^ K, and then Us{K, Af.'^ {E U {i^"}) = 1. 

We get then a manipulation for with a complete base K" , and this completes the proof 
of the lemma. □ 

Let us now give the proof of the main theorem: 

Weak drastic index . By reductio ad absurdum. We assume that A^'^ is a manipulable 
operator and that it is not manipulable by erosion. Then we can find an integrity constraint 
H, a profile E, and two bases K and K' with K' ^ K s.t.: 

idUK, Af{E U {K})) < idUK, Af{E U {K'})). 
Lemma 2 shows that that we can assume [K'] = {w^} complete; it comes: 

idu,{K, AfiE U {K})) < id^,{K, Af;^{E U {^j)). 

This implies that: 

id^{K,Af'{EU{K}) = Q (22) 
idu,{K, A^'^(^UK}) = 1. 
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This means there is no model of K A fi which is a model of A^'^(i? U {K}), and that there 
is at least one model uji of K A fi which is a model ofA;;'^(^U{m). We can express those 
facts by two statements: 

yuj^K An, 3lo' ^^K All, d{J, E U {K}) < d{uj, E U {K}) 

and: 

3uji ^ A/z,Vu; ^ ix,d{uJi,EU{J^}) < d{uj,EU {uj[}). 

Hence: 

3loi 1= K A fi, MoJ \= d{uJi,uj'i) + d{uJi,E) < d{uj, uj'i) + d{io, E) (23) 

Let us now define a new base K" = {cJi}. Since we have supposed the operator not 
manipulable by erosion and since K" \= K, we can then state that it is strategy-proof for 
idu, with K": id^{K, Af:^{E U {K})) > idu,{K, Af:^{E U {K"})). This implies that: 

• either A^'^(S U {K})) = 1, 

. or idUK, Ai'^iE U {K})) = id^{K, Af:^{E U {K"})) = 0. 

From equation (22), we can infer that idw{K, Afi^ {E U {K"})) = 0, and we have Vu; |= 
K An, 3uj' ^^K An, d{uj', E U {K"}) < d{oJ, E U {K"]). 

Since K" = {wi} and the choice of uj' can be made independently of uJi, we have 3u!2 \= 
i^K) A^,Vu; ^ K A n,d{L02,EU {uji}) < d{uj,EU {wi}), that is: 

3^2 \= A /i, Vo; \= K A n-, d{u!2,oJi) + d{uj2,E) < d{uj, ui) + d{uj, E). 
In particular, this statement holds for uj = uJi, because wi \= K A n- Hence: 

d{ijj2,0Ji) + d{uj2,E) < d{uJi,uJi) + d{u)i,E). 
Since d{LOi,u)i) = 0, we obtain finally: 

d{uj2,0Ji) + d{uJ2, E) < d{uJi, E). (24) 

On the other hand, since 0J2 \= n-> with (23), we get: 

d{uJi,uj[) + d{uJi,E) <d{uj2,uj'i) + d{uj2,E). (25) 

Summing (24) and (25) side by side, we get: 

d{ijj2, u)i) +d{(jJ2,E) +d{uji,u)[) +d{(jJi,E) < d{uJi,E) +d{LLi2,uj[) + d{uj2,E). 

Simplifying by d[uJi,E) and d{uj2,E), we obtain: 

d{uj2,i^i) + d{uJi,uj'i) < d{uJ2,uj[)- 
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This contradicts the triangular inequahty. So, if manipulation is possible, then it is possible 
by erosion with a complete base K" = {wi}. 

Strong drastic index. Let us assume that A^'^ is manipulable for i^^- So we can find a 
profile E, an integrity constraint /i and two bases K and K' s.t.: 

i,s{K, Af^^iE U {K})) < Us{K, Af'iE U {K'})). 

This implies that: 

ids{K,Af'{EU{K}) = Q (26) 

and 

ids{K,Af{ElA{K'}) = l. 

This means that there is at least one model of A^'^(£' U {K}) which is not a model of K, 
and that every model of Afi'^{E U {K'}) is a model of K A ^. Let us consider a model u>i 
of Af.'^iE U {K'}). We can write that uji ^ K A fi and: 

Vcj ^/i,d(wi,SU{i^'}) <d(LJ,^U{A''}). 

So we have: 

Vu; \= fx, d{LOi,K') + d{uji,E) < d{uj, K') + d{oj, E). 

Let us define K" = {o^i} and show that there is manipulation with this base. Let us assume 
that we can find uj" Af,'^{E U {K"}) s.t. u" ^ K. Since u" ^ Af^^iE U {wi}), we have 
uj" \= n and 

,EU{uJi}) < d{uji,E U {ui}), 

and then: 

, wi) + d{uj" , < ^) 

(as d{u!i,uji) = 0). 

We know that uj" ^ and uj" \= fi, so we can infer that u" ^ Af^^{E U {A''}) (else we 
should have to" \= K). Since lvi is a model of A"^^ {E {K'}), we have: 

d{uj'\EU{K'}) > d{LOi,EU{K'}). 

Equivalently: 

d{uj'' , K') + d{Lo" , E) > d{uji,K') + d{uji,E). 
Since d{uJi,E) > d{io",uJi) + d{ui^\E), we obtain: 

d{uj'\ K') + d{Lo'\ E) > d{uJi, K') + d{u;\LOi) + d{uj" , E). 

Simplifying this equation by d{u)",E), we get: 

d{uj'\K') > d{uji,K')+d{u'\uJi). 
If ijj2 is a model of K' s.t. d[ijOi, K') = d{uji,uJ2), we have: 

d{uj'\K') > d{uJi,0J2) + d{uj'\oji), 
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and finally, since d{uj" ,uJ2) > d{uj" , K') by definition of min, we get: 

d{uj''\uj2) > d{uJi,uJ2) + d{uj'\uJi). 
This contradicts the triangular inequality. 

We have shown that every model of Af^^{EU{K"}) is a model of K. Hence, ids(.K,K {^U 
{!<"}) = 1. Since ids{K, /S.fl^iE U {A"}) = with (26), we have: 

ias{K, 1!^{E U {K})) < z^siK, /:^f'{E U {/i"'})), 

and a manipulation by erosion with a complete base is possible. 

□ 

Corollary 12 A profile E is manipulable by K for (resp. i^s) given A^'^ and fi if and 
only if the manipulation is possible using a complete base \= K, i.e., there exists \= K 
s.t. ia^iK^/^f'iEUiK^})) > idu,{K,/\'l^'^{EU{K])) (resp. ids{K, Af,'"" {E U {K^})) > 
iUK,Ai'^{EU{K}))). 

Proof: (=^): This is a consequence of Theorem 11 and of Lemma 2, which enable to 
state that if K is manipulable for i = i^w or i = ids given A^' and E, then one can find a 
base K' = {cu'} ^ K complete such that i{K, Afl^ {E U {J})) > i{K, Af,'^ {E U {K})). 

{<=)■ If K is strategy-proof for i = idw or i = ids given Aj^'^ and E, then y[K'] C 
W,i{K,A'l^^{E U {K'}) < i{K,Af,'^{E U {K})). This is in particular true when K' is 
reduced to a singleton. 

□ 

Theorem 14 Amax, Amim, Amin^, and A^ are strategy-proof for idw , ids and ip. 

Proof: Amax (or equivalently Ammj) is strategy-proof for ip. Indeed, if /\E is 

consistent, then all the models of the merged base are models of Ki € E, thus the satisfaction 
of Ki is maximal for ip. li /\E is not consistent, then the merged base is valid. Assume that 
agent 1 reports K[ instead of Ki. If K[ A /\{K2, ■ ■ ■ ,Kn} is consistent, then no model of 
the resulting merged base is a model of Ki. In the case K[ A /\{K2, ■ ■ ■ , Kn} is inconsistent, 
then the resulting merged base is still valid. From Theorem 1, A^ax (or equivalently Amin2) 
is also strategy- proof for the two drastic indexes. 

Amini is also strategy-proof for ip. The case when /\E is consistent is as above, /\E 
is not consistent, the result of the merging is \/ E and all the models of Ki are models 
of the merged base. So, in order to increase the value of the ip index, it is not possible 
to increase the number of models of Ki in the result of the merging. Hence one needs to 
decrease the number of countermodels of Ki in the merged base. But we shall show that 
it is not possible: assume that agent 1 reports K[ instead of Ki. If K[ A /\{K2, . . . , Kn} 
is consistent, then no model of the resulting merged base is a model of Ki (as /\E is not 
consistent). 
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Then K[ A /\{K2, ■ ■ ■ , Kn} is not consistent, and we have: 

i,(K,.A„„.,(K, U IK.„ . . . . A-..})) = ^(|,,^,*fg'^ _^,,)|) 

and 

Armn, (K, U {K2, . . . , K.})) " #^[K[ V ^ {K^, . . . , K^}]) ' 

The numerator of ip{Ki, AmimiKi U {K2, ■ ■ ■ ,Kn})) is maximal, so in order to increase 
ip{Ki, Amim (-f^i U{i^2, • • • J Kn})), we have to decrease the denominator of ip{Ki, Amim {K[ 
U{K2, Kn})), #{[K[ V y{K2, Kn}]). 

We can write the following equality: 

#{[K[ V \/{K2, Kn}]) = #{[K[ AKiA -(\/{^2, • • • , Kn})]) + 

A ^Ki A -( \/{^2, . . . , Kn})]) + #{[\/{K2, Kn}]). 

In this sum, ^{\\/ {K2, . . . , Kn}]) cannot be changed. We have to decrease the two other 
terms of this sum: #([J^| A-^Ki A-i(V{^2, • • • , Kn})]) is minimal if K[ is such that A 
-^Ki A ^{\/{K2, . . . ,Kn})]) = 0. In the following, we suppose then that A -lA'i A 

^{\l{K2,...,Kn})]) = G. 

For the first term of the sum, A i^i A ^{\I{K2, . . . , Kn})]), we can write: 

#{[K[AK^A^{\l{K2,...,Kn})]) = 

A -(\/{^2, . . . , Kn})]) - #{[Ki A A ^(\J{K2, Kn})]) 
So we obtain for the probabilistic index: 

ip{K^,ArnimiK[U{K2,...,Kn})) = 

#{[Ki]) - A A ^{\J{K2, K,,})]) 

#i[K, A -(V{i^2, . . . , Kn})]) - A A -(V{i^2, . . . , Kn})]) + #([V{^2, . . . , /^n}]) ' 

Now remark that if k is an integer and if a < 6, then — f • If we subtract the same 
integer ^{[Ki A ^K[ A ^{\/{K2, ■ ■ ■ , Kn})]) from the numerator and the denominator, then 
we get the following inequation: 

- A ^K[ A ^{\J{K,, . . . , Kn})]) 

A -(V{if2, . . . , - A A -(V{if2, . . . , Kn})]) + my{K2, Kn}]) 

#([^1]) 

#{[K^ A ^{\J{K2, Kn})]) + #{[\J{K2, Kn}]) ' 

So: 

#i[Ki]) 



< 



ip{K,,An,inAK'lU{K2,...,Kn})) < 



.p,...,-n.rn V^^i - ■ ■ ■ , -n, ^ ^^^^^ ^ ^^^^^^^ _ _ _ ^ ^^^^j^ ^ #([V{A-2, • • • , i^„}]) 
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then 

No manipulation is possible, and Amim is strategy-proof for ip. From Theorem 1, Amim is 
also strategy-proof for the two drastic indexes. 

Finally, As is strategy-proof for the three indexes (see Theorem 2). □ 

Theorem 15 A satisfies the (IP) property if and only if for every profile E and every pair 
of bases K and K' : 

• K A -^A{E U {K}) ^ ^A{E U {K'}), and 

• A A(E U {K}) 1= A(^ U {K']). 

Proof: Suppose that a merging operator A = Bel{K,^)) does not satisfy the (IP) 

property. Then there is a profile E, an agent i, an OCF k, an interpretation w G W s.t. 

\k/\{E){uj) - Ki{uj)\ > \KAirep{E, {i}, k){uj) - Ki{uj)\ 

where rep{E, {i}, k) is the profile identical to E except that the OCF Kj is replaced by k. In 
the following we note A(E\J {K}) for Bel{K/^(E)): it is the initial merged base when agent 
i reports her true base K = Bel^Ki), and we note A{E U {K'}) for Bel{Kj\{rep{E, {i}, k)): 
it is the merged base obtained by replacing the base K of agent i by another K' = Bel{K,). 

Focusing on two-strata OCFs, this inequation entails that \kj\{E){uj) — Ki{uj)\ = 1 and 
\Kj\{rep{E,{i}, k){u:) — Ki{uj)\ = 0. Since \KAirep{E,{i}, k){uj) — Ki{u))\ = 0, a; is a model 
of both A{E U {K'}) and of K (*), or a; is a countermodel of both A{E U {K'}) and of K 

To get \ka{E)(lo) — Ki{uj)\ = 1, there are also two cases: 

• either K/\{E){uj) = 1 and Ki{uj) = 0: then a; is a model of K and a countermodel 
of A{E U {K}). Since w is a model of K, with (*), we know that is a model of 
A{E U {K'}). Then cj is a model of K, of -(A(^ U {K})) and not of -nA{E U {K'}): 
it entails that 

K A ^A{E U {K}) ^ ^A{E U {K'}). 

• or HA{E){io) = and Ki{uj) = 1: then a; is a countermodel of K and a model of A{E\J 
{K}). Since is a countermodel of K, with (**), we know that is a countermodel 
of A{E U {K'}). Then u; is a model of ^K, of A{E U {K}) and not of A{E U {K'}): 
it entails that 

A A{E U {K}) ^ A{E U {A"}). 

Hence it is not the case that both 

• A' A -^A{E U {A}) ^ -^A{E U {A'}), and 
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• A A{E U {K}) \= A{E U {A"}), 
are satisfied. 

As to the converse, suppose that there is a profile E, an agent i with a base K, and another 
base K' s.t.: 

K A -^A{E U {K}) ^ ^A{E U {K'}) 

or 

A A(E U {K}) ^ U {K'}). 

In the first case, there is a model w of iiT A ^A{E U {A'}) which is a countermodel of 
^A(^U {K'}) : 

ka{E){u)) = 1, = 0, hiA{rep{E, {i}, k){lv) = 0. 

So 

|KA(-E')(t^) > \KA{rep{E,{i},K){uj) - Ki{uj)\. 

In the second case, there is a model u of -■A' A A(ii^ U {AT}) which is a countermodel of 

a(^u{a:'}): 

ka{E){uj) = 0, = 1, KA{rep{E, {i}, k){uj) = 1. 

So 

\KAiE){uj) - Ki{uj)\ > \KA{rep{E,{i},K){uj) - Ki{uj)\. 
In both cases, A does not satisfy the (IP) property. □ 

Theorem 16 Let iwip{K, Ka) = #{[k<sKa]))+'^ ' ^ satisfies the (WIP) property if and 
only if it is strategy-proof for i^ip ■ 

Proof: By definition AT © Ka = {^K A Ka) V (A' A -■A'a) So we can write: 

1 



iwip{K, Ka) 



#([(-a: a Ka) V (a: a ^Ka)]) + 1 

if and only if 

iwip{K,KA, 



#(hA- A Ka]) + #{[K A ^Ka]) + 1 ■ 



Suppose that a merging operator A = Bel{nA)) does not satisfy the (WIP) property. Then 
there is a profile E^ an agent i, an OCF k s.t. 

S(^ew|«^A(-E')(a;) - Ki{uo)\ > T.^^w\KA{rep{E, {i}, k){uj) - Ki{uj)\ {*) 

In the following we note A(E\J {K}) for Bel{KA{E)), that is the initial merged base when 
agent i reports her true base K = Bel^Ki), and we note A{EU{K'}) for Bel{KA{rep{E, {i}, 
k)), i.e., the merged base obtained by replacing the base K of the agent i by another 
K' = Bel{K). 

In the two-strata case, \ka{E){uj) — Ki{uj)\ is equal to or 1. In fact, \k,a{E){uj) — Ki{uj)\ = 1 
if and only if: 
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• either k/\{E){uj) = 1 and Ki{uj) = 0: this is equivalent to uj \= K A ^A{E U {K}). 

• or kj\{E){lo) = and Ki{u)) = 1: this is equivalent to w j= A A(£^ U {K}). 

We deduce the following equation: 

S^gw|«a(^)M - K,{io)\ = #{[K A -A(^ U {K})]) + #{[^K A A{E U {K})]). 

Similarly, we get: 

^u.ewMrep{E, {i}, k)H - Ki{u;)\ = #{[K A ^A{E U {K'})]) + #(hE: A A{E U {/^'})]) 
The inequation (*) is then equivalent to: 

#([A' A ^A{E U {K})]) + #(hA' A A(i? U {A'})]) > #([A' A -A(A U {A"})]) + #bKA A{E U {K'})]) 
which is equivalent to 

1 

#{[K A ^A{E U {K})]) + #i[^K A A(S U {K})]) + 1 ^ 

1 



a -A(i^ U {K'})]) + #(h/^ A A(i? U {K'})]) + 1 

which is equivalent to 

i^^p{K, A{E U {K})) < i^ip{K, A{E U {K'})) 
which is equivalent to the fact that A is not strategy-proof for iwip- 



□ 
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